feat(cve5): support WordPress ecosystem extraction

[jess-lowe]

Adds support for extracting and converting WordPress vulnerability data (Core, Plugins, Themes) from CVE5 records, with tailored handling for Wordfence, Patchstack, and WPScan CNAs.

Changes

• Added heuristics to extract plugin/theme slugs and determine specific WordPress sub-ecosystems from references and metadata.
• Introduced WordpressExtractor with hookable handlers (WordfenceHandler, PatchstackHandler, WPScanHandler) to address CNA quirks (e.g., version normalization, automated reference generation).
• Ensures both GIT (if available) and ECOSYSTEM ranges are produced for maximum fidelity, keeping them distinct to respect ecosystem boundaries.
• Implemented robust fallbacks to generate ECOSYSTEM ranges from CPE or description text when standard Git resolution is unavailable.

Rationale
WordPress records often rely on SVN or custom CNA identifiers rather than standard Git commits. This change enables high-fidelity ingestion of WordPress-specific data while retaining linkage to Git history where possible, ensuring comprehensive coverage for WordPress users.

[G-Rath]

ooohhh I just realized I'll need to figure out how WordPress versions work for semantic 🫠