Right now, vulndb reports include a Links field:

type Links struct {
  PR      string   `yaml:",omitempty"`
  Commit  string   `yaml:",omitempty"`
  Context []string `yaml:",omitempty"`
}

This has a few problems:

• It assumes there's at most one PR and one commit associated with a report. This isn't always the case.
• The PR and Commit fields suggest that we might want links to both a PR and a commit, which isn't really necessary. For a fix to std, for example, the CL is generally the canonical reference for a change and there's no point in linking the commit on go.googlesource.com as well.
• The "Context" field has less precision than OSV, which has a number of types of reference. (ADVISORY, ARTICLE, FIX, ...)

Let's refactor it.

type ReferenceType string // "ADVISORY", "ARTICLE", etc.

type Reference struct {
  Type ReferenceType
  URL  string
}

type Report struct {
  References []*Reference
}

This aligns with OSV, lets us link to multiple fix CLs, and drops the distinction between "PR" and "commit".

This also gives us the "ADVISORY" type from OSV's references, which we can use for linking to a canonical security advisory for a vulnerability when one exists.