CVE backport reconciliation

Version-based CVE matches are noisy: Linux distributions backport security fixes without changing the version string, so a banner like OpenSSH 7.4 looks vulnerable to dozens of CVEs that are actually already patched. Pick your distribution and we'll cross-check each high-severity match against the vendor's real patch data (Red Hat / CentOS / Rocky / Alma checked live; other distros get authoritative tracker links).