feat: epss percentile filter

[Rexbeast2]

fixes #3242
@terriko Test cases can't be make fixed on as we have for cvss, as the value of epss percentile changes every day.
So the current test case checks if the epss filter works
And I, in particular, don't have any other idea for the test case. Till we design a better test case this would work IG
EPSS for which spelling test is failing would be added by other PR on documentation about EPSS.

[codecov-commenter]

Codecov Report

Merging #3244 (843a392) into main (8f10390) will increase coverage by 0.56%.
The diff coverage is 80.00%.

@@            Coverage Diff             @@
##             main    #3244      +/-   ##
==========================================
+ Coverage   80.99%   81.56%   +0.56%     
==========================================
  Files         722      722              
  Lines       11209    11242      +33     
  Branches     1502     1514      +12     
==========================================
+ Hits         9079     9169      +90     
+ Misses       1726     1677      -49     
+ Partials      404      396       -8     

Flag	Coverage Δ
longtests	80.51% <80.00%> (+0.03%)	⬆️
win-longtests	79.32% <80.00%> (+0.55%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files Changed	Coverage Δ
cve_bin_tool/cve_scanner.py	86.06% <76.92%> (+0.80%)	⬆️
test/test_cli.py	88.11% <77.77%> (-0.66%)	⬇️
cve_bin_tool/cli.py	67.89% <100.00%> (+0.94%)	⬆️

... and 1 file with indirect coverage changes

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

[terriko]

Yeah, testing this is a pain without a way to load a pre-defined test set of data. I think changing the test infrastructure is probably too much to be starting in the last few weeks of GSoC but maybe we could open an issue describing what would be needed in lieu of writing a perfect test here?

How viable would it be to test the behaviour at the edges of the range and do some counting? e.g. we expect min score 0 to return >1000 results and min score 100 to return < 50 (or whatever the actual numbers should be).

[anthonyharrison]

@Rexbeast2 Agree EPSS scores can change daily but really we need the tests to be predictable. Maybe we need to have an option in the EPSS load function to load data from a local file (with known values) rather than always downloading the data.

[terriko]

Okay, let's explore better testing in a separate PR. I'm going to update this branch to make sure it gets the spelling stuff from the previously merged code, but I think I'll probably merge it as-is and make an issue for just the tests if you don't already have one.

[terriko]

Okay. merging now.