Use ABNF to define at least the CVE ID syntax

[zmanion]

Example: https://github.com/CycloneDX/cyclonedx-property-taxonomy?tab=readme-ov-file#abnf-for-official-cyclonedx-property-names