Use id instead of cve where possible when parsing remediations

What does this MR do?

Our analysers will start to generate filed called id. We would like to utilise this filed instead of using cve field when parsing reports only for the remediation part. Change is backward compatible. This is the other issue for analysers side (#36777 (closed)). Here is the MR for analyzer common library. gitlab-org/security-products/analyzers/common!79 (merged)

Related issues

#209851 (closed)

Does this MR meet the acceptance criteria?

Conformity

• Changelog entry
• Code review guidelines
• Merge request performance guidelines
• Style guides