Feat: Add notification when severity of a vulnerability changes

[Ehoky]

Description

Feat: Add notification when severity of a vulnerability changes

Addressed Issue

#2361

Checklist

• I have read and understand the contributing guidelines
• This PR fixes a defect, and I have provided tests to verify that the fix is effective
• This PR implements an enhancement, and I have provided tests to verify that it works as intended
• This PR introduces changes to the database model, and I have added corresponding update logic
• This PR introduces new or alters existing behavior, and I have updated the documentation accordingly

[nscuro]

Thinking of future use-cases here, where perhaps we would want to capture more than just a change in severity, WDYT about having an old and new object instead? This would give us the flexibility to add more properties of interest over time, e.g. CVSS or EPSS scores.

Looking at popular solutions for Change Data Capture, like Debezium, they typically do this, too: https://debezium.io/documentation/reference/stable/connectors/mysql.html#mysql-update-events

I'd imagine something like:

{
  "component": {
    ...
  },
  "project": {
    ...
  },
  "vulnerability": {
    "old": {
      "severity": "MEDIUM"
    },
    "new": {
      "severity": "HIGH"
    }
}

Where old and new may just as well be before and after.

From the DT perspective, this form of communicating changes could be re-used in other notification types as well. WDYT?

cc @Mvld3r

[nscuro]

This computation needs to happen outside of the for loop that dispatches notifications.

Otherwise affectedProjects will grow with each iteration, resulting in all components other than the very last one to not get the complete set of projects.

[nscuro]

Please also include an example JSON of the new notification on this page.

[Ehoky]

Thank you for your feedback. I modified the generation of the JSON structure accordingly, PTAL

[melba-lopez]

Thanks for the contributions @Ehoky! I'm having a hard time visualizing how this would actually work if 100 CVEs get updated. Is it at a global level? a component level? would you pop up 100 alerts?

I definitely have been wanting a notification that tells me if something in a project or about a component has changed. If we think of some BOMs having THOUSANDS of components, or a DT with hundreds of projects, would you inundate the user with too many notifications? Would there be a separate page to show the changes?