Add a first known exploitation date

[tschmidtb51]

This is split out from #782:

It is suggested to add an optional field that provides the opportunity to convey the information, when a vulnerability was first exploited in a specific product. A JSON structure could look like this:

          "known_exploitations": {
            "title": "List of known exploitations",
            "description": "Contains a list of known exploitations",
            "type": "array",
            "minItems": 1,
            "uniqueItems": true,
            "items": {
              "title": "Flag",
              "description": "Contains information on when this vulnerability was first known to be exploited in the product.",
              "type": "object",
              "required": [
                "date",
                "exploitation_date"
              ],
              "properties": {
                "date": {
                  "title": "Date of the information",
                  "description": "Contains the date when the information was last updated.",
                  "type": "string",
                  "format": "date-time"
                },
                "exploitation_date": {
                  "title": "Date of the exploitation",
                  "description": "Contains the date when the exploitation happened",
                  "type": "string",
                  "format": "date-time"
                },
                "group_ids": {
                  "$ref": "#/$defs/product_groups_t"
                },
                "product_ids": {
                  "$ref": "#/$defs/products_t"
                }
              }
            }
          },

[tschmidtb51]

It could also be integrated into the flags but then loose the updated date and reuse the flags date in an unintended way.

[thschaffr]

The motion to add a known exploitation date to CSAF 2.1 has passed in today's meeting. (29.01.2025)
@tschmidtb51 please label accordingly.