https://github.com/RConsortium/r-advisory-database reports vulnerabilities in R packages. (There's not much there, but R-multiverse itself may increase adoption.)

This PR scans https://github.com/RConsortium/r-advisory-database and records vulnerabilities for the given package version in the issue file. For example, for commonmark 0.2, the JSON issue file would look like this:

{
  "descriptions": {
    "advisories": ["https://github.com/RConsortium/r-advisory-database/blob/main/vulns/commonmark/RSEC-2023-6.yaml", "https://github.com/RConsortium/r-advisory-database/blob/main/vulns/commonmark/RSEC-2023-7.yaml", "https://github.com/RConsortium/r-advisory-database/blob/main/vulns/commonmark/RSEC-2023-8.yaml"]
  },
  "date": ["2024-01-01"],
  "version": ["0.2"],
  "remote_hash": ["54c1637c74e7941fbe9f152df70c0a25f8cd37f6"]
}

This keeps packages with reported security vulnerabilities out of Production. However, such packages would still remain in Community. I think this makes sense because even important packages like graph and jsonlite have had vulnerabilities reported for prior versions.

Overall, I think this is a lightweight and practical way to handle security at the package level (r-multiverse/help#80). From a security and safety perspective, I think the only other things we need for the rollout are user-level security (r-multiverse/help#83) and a solid terms of service document (r-multiverse/help#82, r-multiverse/help#86, r-multiverse/r-multiverse.github.io#25).

FYI @jeroen, @maelle