feat(combine-to-osv): support intelligent range merging

[jess-lowe]

This PR refactors the range merging and NVD version extraction logic in vulnfeeds to produce highly precise, schema-compliant, and consolidated OSV records. It unifies repository ranges under a single Affected block, and implements a robust range-merging priority hierarchy (pickBestRange).

• All repository-based Git ranges are now consolidated under a single Affected package object in the output OSV record, significantly improving structure cleanliness.

Intelligent Range Selection & Merging (pickBestRange)

• Fixed Mismatch Priority: Bounded ranges with explicit fixed events are prioritized over open-ended last_affected ranges.
• Constrained Range Priority: Bounded ranges with a specific non-zero introduced commit or version are preferred over generic introduced: "0" ranges.
• CPE_RANGE Source Priority: Ranges derived from explicit CPE ranges are preferred over other sources.
• References-Only Merging: Git commit ranges whose source is strictly "REFERENCES" are now merged (appended) directly into the CVE range rather than discarded.
• Database Specific Merging: When merging ranges, their database_specific metadata maps (including source values and extracted_events) are combined and deduplicated.
• Last-Affected Cleanup: Automatically removes legacy last_affected entries from the chosen or merged range if a fixed event or commit exists.

Also included a DESIGN.md file with the explanations for the flow of data