Inconsistent Severity Levels Reported for Same CVE

[DmitriyLewen]

Description

In some cases, the database doesn't contain Amazon severity.
e.g.:

➜ bbolt get trivy.db vulnerability CVE-2023-37920 | jq
{
  "Title": "python-certifi: Removal of e-Tugra root certificate",
  "Description": "Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes \"e-Tugra\" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from \"e-Tugra\" from the root store.",
  "Severity": "CRITICAL",
  "CweIDs": [
    "CWE-345"
  ],
  "VendorSeverity": {
    "ghsa": 3,
    "nvd": 4,
    "redhat": 1
  },
 ...
}

This can happen because Amazon uses the severity name with the first character either uppercase or lowercase.
e.g.:
Important
important

Discussed in #5757

[DmitriyLewen]

Fix for this - aquasecurity/trivy-db#376