Breaking this out from #88 so it can be addressed independently

Consider including a slot for a vul ID. This needn't be CVE, could be VU#, JVN#, or just a locally-relevant case number from a ticketing system or scan finding ID. I'd probably put it closer to the front than back, so maybe SSVC/v2/VU#99999//

Adding a vul ID breaks some format symmetry with CVSS vectors but I don't think there's a requirement to maintain that degree of symmetry in the first place.