Use official CNA names to identify vulnerability sources

[nscuro]

Current Behavior

Currently, vulnerability sources are identified based on the Vulnerability.Source enum.

Proposed Behavior

It would be better to use official CNA names instead, where applicable:

https://www.cve.org/PartnerInformation/ListofPartners

As identified in #1295, GITHUB should ideally be either GitHub_P or GitHub_M.

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this enhancement was already requested

[sahibamittal]

Needs more research and clarification. CNA partner list does not include the sources clearly and the hardcoded list in the script is missing some of names like ossindex, retire.js, npm etc.