fix(osv): stop adding ID of record to "related" too

[luhring]

The inclusion of the OSV record's ID as a related record was never necessary, and caused confusion downstream, such as on osv.dev.

[luhring]

cc: @andrewpollock @oliverchang @cpanato

[andrewpollock]

Will you retroactively correct existing records after this change?
(If yes, please ensure the modified field is updated also)

[luhring]

Will you retroactively correct existing records after this change? (If yes, please ensure the modified field is updated also)

Interesting, good callout. This is not accounted for in my change so far.

Today we take the latest "event" in our raw advisory data (e.g. this timestamp) and use it as the modified time, which won't change by virtue of modifying how we produce the OSV data from the same (unmodified) raw advisory data. So we probably need some sort of "or X, whichever is later" logic. 🤔