This loads the bug from Bugzilla and fills in as much as possible for a
new advisory from the data found there rather than using a static
template.

Avoid the possibility of security problem due to malicious file names
being interpreted as shell commands.

An unknown key is probably due to a typo, which should be highlighted to
the user.

Consider some non-alphabetic characters as words to expand the check to
catch things like duplicate package names.

Use some simple heuristics to determine if each reference link is an
advisory, a report or a generic link. Despite the simplicity, the
classification ends up being surprisingly accurate, mostly because there
are only a few sites generally used for advisories and reports, and
errors are almost always harmless false negatives which end up in the
generic "web" type.