[FLORA-61] Start the data model for security advisories

[tchoutri]

Proposed changes

This PR introduces the initial data model for security advisories.

The database components are as follow:

• security_advisories, which encode most of the metadata, and to where affected packages refer
• affected_packages represent the packages affected by an advisory, pointing to the advisory. Affected packages have one or multiple affected version ranges associated.
• affected_version_ranges represent a link between an affected package, and the releases where the vulnerability is introduced and fixed.

Linked

• chore: Bump pandoc version in hsec-tools haskell/security-advisories#241

Contributor checklist

• My PR closes Store HSEC advisories in the database #554
• I have read and understood the CONTRIBUTING guide
• I have inserted my change and a link to this PR in the CHANGELOG
• I have updated documentation in ./docs/docs if a public feature has a behaviour change

[MangoIV]

I like this, perhaps we can continue on it later :)

[tchoutri]

@MangoIV The standalone syntax for NFData does not work if the type does not implement Generic

[MangoIV]

if the type does not implement Generic

I mistook that for granted.

[tchoutri]

@TristanCacqueray @blackheaven @frasertweedale Please let me know what you think of this. For the moment I'm filing advisories of the GHC components (haddock included) in the ghc package.

[MangoIV]

I had expected some place to asynchronously propagate a package to be affected to all its reverse dependencies, am I missing where that happens? Or is that a futurework?

I think the data model is fine etc. though.

With regards to actually using this, here's what I imagine:

• a new internal endpoint (or whatever mechanism you use) to invoke the download of the advisories)
• this spawns a process that starts to go through the advisories and for each of them, fetches the reverse deps which each gets a process itself that goes through their reverse deps
• to make sure that not too many processes are spawned, you can use a QSem (quantity semaphore) which the processes block on if there's already enough of them chewing.

[tchoutri]

@MangoIV yes, the propagation of the information is the next PR, I just wanted to focus on the data model here. :)

[blackheaven]

You're very tightly coupled to hsec, but, aside of that, it seems coherent.

[blackheaven]

Suggested change

	forM_ advisories $ \advisory -> processAdvisory advisory
	mapM_ processAdvisory advisories

[tchoutri]

@blackheaven I'm interested in how I could become less coupled to hsec! :)