Keep reviewed resource ranges fixed

[p-linnane]

After Homebrew/brew#23830, the last Ingest run matched 76,300 records and then failed in advisories:filter because 33 tracked matched records lost their range_state: six ansible-core CVEs across ansible, ansible@9, ansible@10, ansible@12 and ansible@13, and three npm CVEs on node. Each record has a fixed resource beside a subject the matcher cannot compare, the Git repository for ansible and node or the PyPI ansible identity added during distro resolution for the versioned formulae.

This adds a range_state: fixed override for each of the 33 pairs and a spec that pins every record to fixed with a resource, a resource_purl and, except for CVE-2023-4237 whose upstream range ends in last_affected, an upstream_fixed_in. State-only overrides are deliberate: with Homebrew/brew#23856 the matcher inherits the per-formula upstream fix from the fixed resource evidence, so pinning upstream_fixed_in would freeze values that differ per formula. Every shipped ansible-core and npm version is past its upstream bound, so no affected version is hidden.

Lands after Homebrew/brew#23856 is on the Ingest runner. A local brew advisory-match run for the six formulae with that brew change and these overrides leaves all 33 records unchanged and advisories:filter clean; with the current brew it passes the filter but strips upstream_fixed_in from 28 records, which is why the order matters.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.