Reorder version ranges in some Jenkins CVEs towards JSON v5

[daniel-beck]

CVE JSON v5 has an unambiguous definition how to interpret version ranges, something previously missing (as discussed in github/advisory-database#771).

(While JSON v5 states that

The versions matched by different objects should be disjoint

it is not a requirement, and the algorithm

for entry in product.versions {
	if entry matches V {
		return status specified by entry for V
	}
}
return product.defaultStatus

provides an unambiguous result for overlapping version range specifications.)

This is an update of some affected Jenkins CVEs to see whether they'd be migrated to JSON v5 in a way that properly excludes the specified backports from the version ranges.

This does not address the problem of future releases on the backport branch, but I don't think that can be done with JSON v4 anyway. This also does not fix all 2020-2022 CVEs in Jenkins affected by this problem -- that's a followup PR if this one is successful.

[Kevin-CB]

Syntax reviewed