Difficulties in cross-clone version comparison

[willmurphyscode]

Consider two version numbers:

[root@19ac959dacf7 /]# rpmdev-vercmp 3:10.3.28-1.module_el8.3.0+757+d382997d 3:10.3.28-1.module+el8.3.0+10472+7adc332a
3:10.3.28-1.module_el8.3.0+757+d382997d < 3:10.3.28-1.module+el8.3.0+10472+7adc332a

This is correct! build 757 is earlier than build 10472. However, if we're comparing Centos8 artifacts against RHEL8 data (which we do), than it is incorrect, because the build numbers are not comparable.

In other words, when comparing module build numbers within RHEL itself, build number is potentially an important part of the version number. However, when comparing across clones (e.g. RHEL to centOS), the build number is not a valid part of the comparison.

We should investigate two different courses of action:

1. For the RHEL clones that we compare to RHEL vulnerabilities, we should examine whether they have a reliable vuln feed we can use instead
2. We should change Grype code so that the version comparison is aware of whether it is comparing across clones

Originally posted by @willmurphyscode in #2375 (comment)