TuxCare: version queries return nothing for CentOS, CentOS-Stream, OracleLinux and RHEL advisories #6257

TuxCare ELS advisories use the inner ecosystem names CentOS, CentOS-Stream, OracleLinux and RHEL (for example TuxCare:CentOS:7). TuxCare resolves the inner name in the global ecosystem registry (osv/ecosystems/_ecosystems.py is_known()/get(), and resolve() in go/osv/ecosystem/tuxcare.go), where these names do not exist. Version parsing then fails, the query falls back to an exact match on versions, and TuxCare records only have ranges, so /v1/query with a version returns no vulnerabilities.

Example on the live API:

In the tuxcare-osv data at e0dbd2d this affects 2,975 of the 5,651 non-withdrawn els_os records (CentOS 6/7/8.4/8.5, CentOS-Stream 8, OracleLinux 6/7, RHEL 7/8), so scanners querying osv.dev by version get no results for those hosts. Reported to TuxCare in cloudlinux/tuxcare-osv#10; google/osv-scanner#2917 is the scanner side and is out of scope here.

Proposed fix: map these four inner names to RPM version ordering inside the TuxCare ecosystem only, in both Python and Go, without adding them to the global ecosystem list (they are not OSV schema ecosystems). CentOS:7 on its own would stay unknown; unknown inner names and nested TuxCare:TuxCare:... would behave as today.

I have this implemented with tests in both languages (allowed, denied and invalid-version cases; it fails on master and passes with the change, and a local replay of index and query matching on CLSA-2025-1751271968 marks 1:1.0.2k-19.el7 as affected and the fixed version as not). Could this be assigned to me so I can open the PR?

cc @Korulag