[GHSA sync] handled related IDs

[reedloden]

Sometimes we have multiple IDs combined together into one advisory.

One example of this is gems/bootstrap/CVE-2018-14040.yml. The GHSA sync script doesn't understand that CVE-2018-14042 is part of this same advisory.

[reedloden]

@rschultheis ^^

[jasnow]

The idea behind this issue is for the GHSA sync script to combine multiple GHSA advisories into one (fewer) ruby-advisory-db advisories and use related:/cvs: field and related:/ghsa: field because they are the "same" advisory.