Add CVE as reference in existing importers

[Hritik14]

Some importers (eg https://github.com/nexB/vulnerablecode/blob/87ffa8109e4f5dcb22b4c8d71eaf1711c82068d7/vulnerabilities/importers/istio.py#L201-L204, https://github.com/nexB/vulnerablecode/blob/87ffa8109e4f5dcb22b4c8d71eaf1711c82068d7/vulnerabilities/importers/alpine_linux.py#L174) do not add the CVE as a reference when it already exists as vulnerability_id.

This has been discussed here: #393 (comment)

[pombredanne]

Note that this will be also be always an alias