Somewhat triggered by #9402, ORT's advisor data model should generally allow to distinguish between vulnerabilities for which a fix already exists (in a newer version of the package) and vulnerabilities for which no fix exists. This would allow users to prioritize those vulnerabilities for which a fix is available.