Remove `cve` property from report finding entity

What does this MR do and why?

This is the second try of removing the CVE property from our parsers and ingestion logic. The first try introduced a flaky spec and reverted.

Related to Remove security report ingestion of cve fields (#368371 - closed).