Do not reply that a package has an unfixed vulnerability when in fact it is malicious

[jhrozek]

Summary

Malicious packages that have a vulnerability entry MAL- are in fact
malicious. Our OSV evaluator handled the MAL- vulnerabilities the same
as all the others which meant that it would just reply with "A
vulnerability was found, but no fixed version exists yet".

A malicious package is unlikely to not be malicious again, so let's put
a sterner warning including a link to the vulnerability into the reply.

Fixes: #4528

Change Type

• Bug fix (resolves an issue without affecting existing features)
• Feature (adds new functionality without breaking changes)
• Breaking change (may impact existing functionalities or require documentation updates)
• Documentation (updates or additions to documentation)
• Refactoring or test improvements (no bug fixes or new functionality)

Testing

manually, see e.g. jakubtestorg/bad-python#266

Review Checklist:

• Reviewed my own code for quality and clarity.
• Added comments to complex or tricky code sections.
• Updated any affected documentation.
• Included tests that validate the fix or feature.
• Checked that related changes are merged.

[coveralls]

coverage: 52.83% (-0.009%) from 52.839%
when pulling c1362c9 on jhrozek:mal_is_not_cve
into fabeea9 on stacklok:main.