Consider some non-alphabetic characters as words to expand the check to
catch things like duplicate package names.

Use some simple heuristics to determine if each reference link is an
advisory, a report or a generic link. Despite the simplicity, the
classification ends up being surprisingly accurate, mostly because there
are only a few sites generally used for advisories and reports, and
errors are almost always harmless false negatives which end up in the
generic "web" type.

These are real typos more than 95% of time (based on current
statistics) and worth eliminating.

These must maintain strict syntax so that they can be referred to by
others, especially in the advisory.json format.

This field is a better match for these than "related".