Changes to vuln 0.1 spec and documentation

[lumjjb]

Addressing #391 and #390, and making several changes which help with implementing the spec. Comments welcome! Am happy to split up the changes if some of them may be potentially controversial. Tagging original author: @hectorj2f

#390

• List types updated to disambiguate list types.

#391

• Remove invocation from example (which is not in the spec).
• Removed the additional "vulnerability" object indirection
  from the spec since it is the only field within it (as reflected in
  the example).
• Severity changed to a list to contain multiple scores (as reflected in
  the example).

Make several fields which may not always be available optional.

• ScanStartedOn changed from required to optional as it may not always be
  available.
• scanner.db.lastUpdate changed from required to optional since this information
  may not always be available when a DB uri/version is known.

[hectorj2f]

@lumjjb Could we get this PR merged first #345 ?

[TomHennen]

@lumjjb Could we get this PR merged first #345 ?

That makes sense to me. Also, please let me know if you're waiting on me for #345. I don't want to hold anyone up!

[lumjjb]

@hectorj2f can you validate if any of the suggested changes here would reflect in #345 as well?

fyi, i don't have maintainer bit here, so no control over that :)