Status should probably be a single field rather than an array

[jcrossley3]

This was an observation in #1006 that I think warrants its own issue...

The response from /api/v1/vulnerability/{id} contains a field advisories.sboms.status which is an array and not a single field. That technically means that an a Single advisory can say that an SBOM has the status affected and not_affected at the same time. E.g.

{
  "advisories": [
    {
      "identifier": "Advisory1",
      "sboms": [
        {
          "id": "Sbom1",
          "status": ["affected", "not_affected"]
          // other fields
        },
      ]
    }
  ]
}

This structure forces the client to come up with some kind of algorithm to parse the data and solve conflicts between multiple advisory.sboms.status values which might contradict each other.