cravex2-reachability: Consume extended reachability in DejaCode CRAVEX

[pombredanne]

Extend the basic CRAVEX Vulnerability exploitability: Reachability integration to pull and store the extended reachability result determination for a given product's packages

[TG1999]

Some pointers

• Product codebase scanned in Scancode.io project
• Run package scan and a vulnerability lookup scan
• For each vuln, assume we have fix commits in VCIO
• For each vuln collect all symbols of codebase
• Update for Package-vuln, evidence of reachability in SCIO
• Need to be made available in SCIO, API and UI
• Run the SCIO pipeline to get vulnerabilities on the packages with reachability information

[tdruez]

Implemented in:

• [cravex2-reachability] Consume extended reachability from symbols analysis #568

Import reachability from scan reachability analysis

• Leverages the values exposed by the ScanCode.io API as implemented in cravex2-reachability: Expose reachability in API scancode.io#2205
• is_reachable imported from scan entries and writes it to VulnerabilityAnalysis.is_reachable
• Validation moved from mixin to AnalysisPreset
• Unit tests covering reachability data import