fix: more nvd optimisations and badrepo cache

[jess-lowe]

This change fixes some nits, introduces a bad repository cache and stops the conversion from discarding versions just because a commit was provided in the references.

• Removed CVEID from error formatting as at time of logging, CVEID is already provided via slog.
• Removed warnings from some logs in favour of adding to metrics.Notes file for better investigation later. There may be value in keeping these at warning levels only if we also are prepared to handle investigating spikes, in which case logs should appear closer to what is causing the errors (network requests generally).
• made errors lowercase as linter demands