feat(extract/microsoft): derive Supersedes field from SupersededBy

- Add DeriveSupersedes to pkg/extract/microsoft/util, inverting SupersededBy
  to populate Supersedes at both KB-level and Update-level
- Add Supersedes field to KB and Update types
- Refactor bulletin, cvrf, msuc, wsusscn2 extractors to use DeriveSupersedes
- msuc/wsusscn2 use a two-pass approach: write SupersededBy in pass 1,
  read all KB files and derive Supersedes in pass 2
- Add TestDeriveSupersedes covering KB-level, Update-level, edge cases

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: MaineK00n

pkg/extract/microsoft/bulletin/bulletin.go

@@ -32,9 +32,9 @@ import (
 	vulnerabilityContentTypes "github.com/MaineK00n/vuls-data-update/pkg/extract/types/data/vulnerability/content"
 	datasourceTypes "github.com/MaineK00n/vuls-data-update/pkg/extract/types/datasource"
 	repositoryTypes "github.com/MaineK00n/vuls-data-update/pkg/extract/types/datasource/repository"
-	sourceTypes "github.com/MaineK00n/vuls-data-update/pkg/extract/types/source"
 	microsoftkbTypes "github.com/MaineK00n/vuls-data-update/pkg/extract/types/microsoftkb"
 	microsoftkbSupersededByTypes "github.com/MaineK00n/vuls-data-update/pkg/extract/types/microsoftkb/supersededby"
+	sourceTypes "github.com/MaineK00n/vuls-data-update/pkg/extract/types/source"
 	"github.com/MaineK00n/vuls-data-update/pkg/extract/util"
 	utilgit "github.com/MaineK00n/vuls-data-update/pkg/extract/util/git"
 	utiljson "github.com/MaineK00n/vuls-data-update/pkg/extract/util/json"
@@ -564,6 +564,7 @@ func (e extractor) extract(rows []bulletin.Bulletin) ([]dataTypes.Data, []micros
 			},
 		})
 	}
+	microsoftutil.DeriveSupersedes(kbs)
 
 	return datas, kbs, nil
 }

pkg/extract/microsoft/bulletin/testdata/golden/microsoftkb/4014xxx/4014329.json

@@ -4,6 +4,11 @@
 	"products": [
 		"Adobe Flash Player on Windows 10 Version 1511 for x64-based Systems"
 	],
+	"supersedes": [
+		{
+			"kb_id": "4010250"
+		}
+	],
 	"data_source": {
 		"id": "microsoft-bulletin",
 		"raws": [

pkg/extract/microsoft/bulletin/testdata/golden/microsoftkb/955xxx/955069.json

@@ -4,6 +4,11 @@
 	"products": [
 		"Microsoft XML Core Services 3.0 on Microsoft Windows 2000 Service Pack 4"
 	],
+	"supersedes": [
+		{
+			"kb_id": "936021"
+		}
+	],
 	"data_source": {
 		"id": "microsoft-bulletin",
 		"raws": [

pkg/extract/microsoft/cvrf/cvrf.go

@@ -307,7 +307,9 @@ func (e extractor) extract(c cvrf.CVRF) ([]dataTypes.Data, []microsoftkbTypes.KB
 		})
 	}
 
-	return datas, slices.Collect(maps.Values(kbm)), nil
+	kbs := slices.Collect(maps.Values(kbm))
+	microsoftutil.DeriveSupersedes(kbs)
+	return datas, kbs, nil
 }
 func collectProducts(pt cvrf.ProductTree) map[string]string {
 	m := make(map[string]string)
@@ -2033,8 +2035,8 @@ func (e extractor) collectKBs(v cvrf.Vulnerability, products map[string]string,
 			// Mixed formats (e.g. "MS16-016, 3124280; MS16-097, 3178034") also exist;
 			// non-digit tokens (bulletin IDs) are filtered out by the isAllDigits check below.
 			var supKBIDs []string
-			for _, semiPart := range strings.Split(r.Supercedence, ";") {
-				for _, commaPart := range strings.Split(semiPart, ",") {
+			for semiPart := range strings.SplitSeq(r.Supercedence, ";") {
+				for commaPart := range strings.SplitSeq(semiPart, ",") {
 					supKBIDs = append(supKBIDs, strings.TrimSpace(commaPart))
 				}
 			}

pkg/extract/microsoft/cvrf/testdata/golden/microsoftkb/3135xxx/3135456.json

@@ -8,6 +8,11 @@
 		"Windows Server 2012 R2",
 		"Windows Server 2012 R2 (Server Core installation)"
 	],
+	"supersedes": [
+		{
+			"kb_id": "3087088"
+		}
+	],
 	"data_source": {
 		"id": "microsoft-cvrf",
 		"raws": [

pkg/extract/microsoft/cvrf/testdata/golden/microsoftkb/3147xxx/3147461.json

@@ -4,6 +4,11 @@
 	"products": [
 		"Windows 10 for x64-based Systems"
 	],
+	"supersedes": [
+		{
+			"kb_id": "3140745"
+		}
+	],
 	"data_source": {
 		"id": "microsoft-cvrf",
 		"raws": [

pkg/extract/microsoft/cvrf/testdata/golden/microsoftkb/5019xxx/5019964.json

@@ -7,6 +7,11 @@
 		"Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016",
 		"Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016 (Server Core installation)"
 	],
+	"supersedes": [
+		{
+			"kb_id": "5018411"
+		}
+	],
 	"data_source": {
 		"id": "microsoft-cvrf",
 		"raws": [

pkg/extract/microsoft/cvrf/testdata/golden/microsoftkb/5020xxx/5020687.json

@@ -6,6 +6,17 @@
 		"Microsoft .NET Framework 4.8 on Windows 10 Version 21H2 for ARM64-based Systems",
 		"Microsoft .NET Framework 4.8 on Windows 10 Version 21H2 for x64-based Systems"
 	],
+	"supersedes": [
+		{
+			"kb_id": "5017500"
+		},
+		{
+			"kb_id": "5018545"
+		},
+		{
+			"kb_id": "5018858"
+		}
+	],
 	"data_source": {
 		"id": "microsoft-cvrf",
 		"raws": [

pkg/extract/microsoft/cvrf/testdata/golden/microsoftkb/5027xxx/5027536.json

@@ -8,6 +8,11 @@
 		"Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019",
 		"Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019 (Server Core installation)"
 	],
+	"supersedes": [
+		{
+			"kb_id": "5022782"
+		}
+	],
 	"data_source": {
 		"id": "microsoft-cvrf",
 		"raws": [

pkg/extract/microsoft/cvrf/testdata/golden/microsoftkb/5027xxx/5027543.json

@@ -7,6 +7,11 @@
 		"Microsoft .NET Framework 3.0 Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2",
 		"Microsoft .NET Framework 3.0 Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2"
 	],
+	"supersedes": [
+		{
+			"kb_id": "5022734"
+		}
+	],
 	"data_source": {
 		"id": "microsoft-cvrf",
 		"raws": [