fix(adv): validate that advisory IDs are CGA IDs

[luhring]

Before, we were only validating that the ID was a valid vulnerability ID, but not specifically a valid CGA ID.

Example

$ w adv validate
❌ advisory data is not valid.

basic validation failure(s):
    grafana-10.3:
        advisories:
            CVE-2024-28180:
                "CVE-2024-28180" is not a valid CGA ID

[luhring]

Should've checked the other tests that were relying on the looser validation 🤦 I'll clean those up!