Investigate downstream advisory usage

[amousset]

As discussed in #1738 (comment), issuing an informational="notice" advisory would cause alerts similar to actual vulnerabilities in some cases, which is undesirable and prevents using this type of advisory in some cases.

Our informational advisories seem to map quite poorly in most vulnerability-handling contexts, and we may consider skipping some of them in the export for osv.dev

I started a broader review of of the vulnerability audit ecosystem consumes our advisories (and other Rust-related advisories too). The test repository with the current results is https://github.com/amousset/vulnerable_crate.