Change cve-osv source to point at cve.org instead

[jess-lowe]

Not all the data we get on the CVE prefix comes from the NVD now, so for more accurate reports from the original poster, we should have the source be cve.org