Parse v3 advisory records

What does this MR do?

The v3 advisory export keeps the v2 {advisory, packages} envelope and every v2 field. The one change is cvss_v4, which leaves the additional_fields wrapper and arrives as an ordinary key on the advisory. AdvisoryDataObjectV3 overrides only where that value is read from, and DataObjectFabricator picks it for an advisories config in v3.

A subclass rather than a new class because I compared the same advisory in both exports and the records are otherwise identical, and no new fabricator because DataObjectFabricator already serves v3 for licenses. The fixture is a real record from the private v3 bucket. One thing the issue does not mention: published_date also changes, from a Go timestamp string to an ISO date, in all 3,933 records I checked. Both cast to the same date column, so nothing reads it differently.

Relates to

#631386