updater/driver: add the ability to signal "removal" in an update

[hdonnay]

No description provided.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 55.82%. Comparing base (ffcb29e) to head (4fb218e).
⚠️ Report is 601 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1179      +/-   ##
==========================================
- Coverage   55.86%   55.82%   -0.05%     
==========================================
  Files         266      266              
  Lines       16625    16625              
==========================================
- Hits         9288     9281       -7     
- Misses       6374     6379       +5     
- Partials      963      965       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[crozzy]

Just to mention: I had the realization that for us the Name is generic i.e. for some VEX CVE files we generate 100s of vulnerabilities with the same name (CVE-2023-001 for samba, CVE-2023-001 for samba-libs etc). This didn't actually change much except that the UpdateVulnerabilities() method now parses existing vulnerabilities into a map[string][]string, where the key is the name (CVE-2023-001) and the value is a list of all vuln ID that share that name.

[crozzy]

All that to say, I think this is still valid, it's just worth pointing out the nuanced difference

[hdonnay]

Right -- this isn't in use yet, but I imagine this is in the current Updater's namespace