Yarn Berry analyzer does not report vulnerability score

Describe the bug The Yarn Berry analyzer does not report vulnerability scores. Hence, you cannot automatically fail executions based on CVSS evaluation (failBuildOnCVSS parameter).

This in turn makes vulnerabilities in Yarn Berry projects effectively go unnoticed!

Version of dependency-check used 12.2.2

To Reproduce See the reproducer (for both Yarn versions) at https://github.com/marcelstoer/odc-yarn-berry-reproducer

Expected behavior Running ODC with failBuildOnCVSS=7 should fail for any NPM package that has vulnerabilities with CVSS scores >=7.

Preliminary analysis AFAIU the issue is in the YarnAuditAnalyzer.java analyzePackageWithYarnBerry() → parseAdvisoryJsons() sequence. There is no CVSS score ever extracted or set on the Advisory object. With Yarn Classic we hit the npm audit API directly and get back full advisory data (including numeric CVSS scores).

1. yarn npm audit --json emits a text "Severity": "Moderate" field.
2. parseAdvisoryJsons() copies that string into advisory.setSeverity(severity). No CVSS number is parsed or stored.
3. The resulting Advisory has no numeric score → dependency-check reports it as "Unscored" with severity label "moderate".
4. -DfailBuildOnCVSS=7 compares against a numeric score that doesn't exist.

Running yarn npm audit --all --recursive --no-deprecations --json gives me this (stripped):

{
  "value": "uuid",
  "children": {
    "ID": 1119441,
    "Issue": "uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
    "URL": "https://github.com/advisories/GHSA-w5hq-g745-h8pq",
    "Severity": "moderate",
    "Vulnerable Versions": "<11.1.1",
    "Tree Versions": [
      "3.3.2"
    ],
    "Dependents": [
      "@ti8m/workbench-widget-loader@workspace:."
    ]
  }
}

Tagging @segovia as the original contributor of the Berry analyzer.