fix(supply-chain): normalize GHSA "MODERATE" severity to MEDIUM

[udsy19]

Fixes #587.

Impact: silent-wrong-result

Who reaches this: any user of the CLI or MCP scan_skill entry point that scans a skill whose
dependency manifest (requirements.txt, package.json + lockfile, etc.) pins a package version
with a known GHSA advisory, via the SC4 supply-chain rule's OSV.dev lookup in
src/skillspector/nodes/analyzers/osv_client.py and static_patterns_supply_chain.py.

Triggered when: OSV.dev reports a database_specific.severity of "MODERATE" for the advisory —
GHSA's own severity scale, not "MEDIUM". Confirmed live against api.osv.dev right now (see the
linked issue for the exact query and response). _severity_from_vuln() passed that string through
unmodified, so _SEVERITY_ORDER, _osv_severity_to_app(), and _SEVERITY_CONFIDENCE in
static_patterns_supply_chain.py — which only recognize LOW/MEDIUM/HIGH/CRITICAL — all
fell through to their LOW default.

What the user observes: the SC4 finding for a MODERATE-severity advisory is reported at
Severity.LOW / confidence 0.6 instead of Severity.MEDIUM / confidence 0.7, with no error or log
line indicating anything was downgraded.

Fix

Normalize "MODERATE" to "MEDIUM" once, at the boundary in _severity_from_vuln() where the raw
GHSA/ecosystem severity string is read, so every downstream table keeps working against the app's
own four-level vocabulary.

Tests

Added tests/unit/test_osv_client.py::TestSeverityFromVuln::test_ghsa_moderate_normalizes_to_medium,
::test_ecosystem_specific_moderate_normalizes_to_medium, and an end-to-end
TestQueryBatch::test_batch_query_ghsa_moderate_normalizes_to_medium that mocks the real OSV.dev
HTTP response shape (database_specific.severity: "MODERATE") and asserts query_batch() returns
severity == "MEDIUM".

Negative control: reverted src/skillspector/nodes/analyzers/osv_client.py to its pristine state
and re-ran the three new tests without the fix:

FFF                                                                      [100%]
=================================== FAILURES ===================================
_________ TestSeverityFromVuln.test_ghsa_moderate_normalizes_to_medium _________
E       AssertionError: assert 'MODERATE' == 'MEDIUM'
__ TestSeverityFromVuln.test_ecosystem_specific_moderate_normalizes_to_medium __
E       AssertionError: assert 'MODERATE' == 'MEDIUM'
______ TestQueryBatch.test_batch_query_ghsa_moderate_normalizes_to_medium ______
E       AssertionError: assert 'MODERATE' == 'MEDIUM'
=========================== short test summary info ============================
3 failed in 2.24s

With the fix restored, all three pass (3 passed), confirming the asymmetry. Also ran the full
tests/unit/test_osv_client.py (36 passed) and the supply-chain SC4 tests in
tests/unit/test_patterns_new.py (84 passed) with no regressions. ruff check, ruff format --check, and mypy are clean on both changed files.

Signed-off-by: Udaya Tejas udayatejas2004@gmail.com