Add new script to fetch CVE descriptions from MITRE

The NVD files are going away, and it's easier to switch to the MITRE 'API' than to the new NVD one.

Closes: #1053702

There's a couple of TODO notes, but the script is working well in my tests, so they don't have to be done right now. For the former, I'll see about creating a utility file to work with the MITRE main.zip file. For the latter, we probably want to clean up things to remove those unused fields (they have been unused for a while, perhaps since the NVD XML files became unavailable).

Another TODO, after this is merged and the tracker service is updated, would be to remove update-nvd and nvd.py, but I can take care of that later. I didn't want to do it in this same MR to avoid breaking the tracker and to ease a temporary switch back if needed.