Use some simple heuristics to determine if each reference link is an
advisory, a report or a generic link. Despite the simplicity, the
classification ends up being surprisingly accurate, mostly because there
are only a few sites generally used for advisories and reports, and
errors are almost always harmless false negatives which end up in the
generic "web" type.

This field is a better match for these than "related".

This identifies the packages as source packages, which is the only type
we supply in advisories.  This is done in the same way as Debian, Ubuntu
and Alpine (at least) and indicates that the package is not the binary
package that is usually installed by users.

This file grows unbounded with all vulnerabilities so reducing its size
even by a little can be valuable.

The default JSON encoding assumed the input was Latin-1, not the UTF-8
it is.

This results in deterministic output, so multiple runs will produce the
same output.