Make vulnerability level an environment variable and not just and only CRITICAL

[rascasoft]

We can use CRITICAL as default, but only if the VULNERABILITY_SEVERITY env variable is not declared.