Group using related field for specific ecosystems

[another-rex]

Some ecosystems like Debian use related field to specify that a DSA covers multiple CVEs. This is placed in related instead of aliases because this relation is not necessarily reflexive (i.e. a DSA covers N CVEs, but each CVE don't fully cover a DSA), but normal aliases are reflexive.

For the purposes of grouping, we should group DSA related and the CVEs it covers to avoid showing overlapping vulnerability results.