report: fixes a nil dereference when accessing vuln cve metadata.

Some vulnerabilities, such as GO-2020-0002.toml, do not have CVE
metadata. Accessing CVEMetadata.ID without checking if CVEMetadata is
nil can lead to a nil dereference.

Change-Id: I06a24a7d80a0e8be768af198a1b6254f15de98d3
Reviewed-on: https://team-review.git.corp.google.com/c/golang/vulndb/+/1026682
Reviewed-by: Roland Shoemaker <bracewell@google.com>

Author: zpavlinovic

report/report.go

@@ -105,7 +105,7 @@ func (vuln *Report) Lint() error {
 		return fmt.Errorf("unknown severity %q", vuln.Severity)
 	}
 
-	if vuln.CVE != "" && vuln.CVEMetadata.ID != "" {
+	if vuln.CVE != "" && vuln.CVEMetadata != nil && vuln.CVEMetadata.ID != "" {
 		// TODO: may just want to use one of these? :shrug:
 		return errors.New("only one of cve and cve_metadata.id should be present")
 	}