Add support for parsing DISTRIB_CODENAME vs just Ubuntu only about sec-cvescan

[setharnold]

We don't currently have the resources to give this the attention it deserves.

I'm not sure pop_OS and mint are really "close enough" here -- I believe they've both replaced the kernel packages with their own, and probably there is more changed, too. Doubtless some packages are unique to them, some unique to Ubuntu.

It might be right for 99.9% of packages, but at least the Linux kernel is a vastly important example where the data just plain wouldn't be correct. The other packages that they've replaced or added would also be important, in the sense that they represent a good chunk of the user experience for pop_OS or mint users -- software we know would be in wide use in those communities.

Do either pop_OS or mint publish OVAL data feeds for their security updates? Or otherwise make their data available? That would probably be necessary to having a good experience. Maybe a generic list of packages with known incorrect statuses, something to skip..

But, like I said, I don't see us returning to cvescan in any real way soon, so please don't invest much time into it, I don't think we'll be able to reciprocate.

Thanks