Fields unification, data deduplication and presentation in OSV

[kam193]

I've noticed a few UX points we should address one day, probably in coordination with other projects. Leaving an issue before I forget about it.

1. database_specific.ioc.* vs. affected.[].database_specific.indicators.*

The first comes from https://github.com/ossf/malicious-packages/blob/main/docs/schema_additions.md#iocs-fields-under-development and it's what I use, the second form is used by Amazon Inspector. I think logically both make sense: I currently collect IoC per-campaign, while Amazon Inspector is able to assign them to a specific version. However, the osv.dev treats them a bit differently: the first is directly visible, and the second needs explicit unhiding:

https://osv.dev/vulnerability/MAL-2026-5769 vs. https://osv.dev/vulnerability/MAL-2026-5786

Notably, the OSV.dev representation does not show which version these fields are related to (but it's still in JSON).

2. OSSF/MAL does not remove duplicated dictionary entries in affected.[].database_specific.*.*, which ends up in things like

   malicious-packages/osv/malicious/npm/@solana-labs/ancor/MAL-2026-5786.json

   Lines 22 to 54 in 478789b

   	"database_specific": {
   	"cwes": [
   	{
   	"cweId": "CWE-506",
   	"description": "The product contains code that appears to be malicious in nature.",
   	"name": "Embedded Malicious Code"
   	},
   	{
   	"cweId": "CWE-506",
   	"description": "The product contains code that appears to be malicious in nature.",
   	"name": "Embedded Malicious Code"
   	},
   	{
   	"cweId": "CWE-506",
   	"description": "The product contains code that appears to be malicious in nature.",
   	"name": "Embedded Malicious Code"
   	},
   	{
   	"cweId": "CWE-506",
   	"description": "The product contains code that appears to be malicious in nature.",
   	"name": "Embedded Malicious Code"
   	},
   	{
   	"cweId": "CWE-506",
   	"description": "The product contains code that appears to be malicious in nature.",
   	"name": "Embedded Malicious Code"
   	},
   	{
   	"cweId": "CWE-506",
   	"description": "The product contains code that appears to be malicious in nature.",
   	"name": "Embedded Malicious Code"
   	}
   	],

3. Each report generates a new malicious-packages-origins entry, which is by default presented on OSV.dev. It works well when we have 1-3 source reports, but it starts to be a bit counterproductive after that. From my side, every update to the campaign overview causes updates to older reports and a new entry; Amazon Inspector often provides data in a few separated reports merged later by OSSF/MAL. And we also have other sources. And new versions. And we end up in OSV.dev looking like in https://osv.dev/vulnerability/MAL-2026-5786

I think it hides the more important information like references and details in next section. It would be great to have malicious-packages-origins hidden by default or put in a different place - this would require asking OSV.dev team for help.