Non-sequential Cve-Id reservation algorithm has had no security analysis

[jdaigneau5]

Summary

The algorithm for reserving non-sequential Cve-Ids hasn't had a security analysis to confirm that the there's no pattern in the reserved group of Cve-ids.

Proposed Actions

• Deprecate this feature, as few CNAs use it
• Leave feature as is, but explicitly say it does not guarantee obscurity
• Request a secure analysis be done

[jdaigneau5]

AWG 8/13/24: Update Swagger docs for this endpoint clarifying that non-sequential does not guarantee randomness.