npm audit --json should return a stable source ID for vulnerabilities

[stevendarby]

The source property on a vulnerability changes every time the GitHub advisory is updated. Tools like npm-audit-resolver use this as an ID in their resolution files, so its mutability often makes the resolutions short-lived. There has previously been an indication that the mutability would be removed (see naugtur/npm-audit-resolver#56 (comment)). This issue is to check in on that plan and also show some support for that idea.