Improve CVE - Derivation Matching Accuracy, Data Integrity, and Observability in the Nixpkgs Tracker

This project focuses on improving the accuracy, reliability, and observability of the Nixpkgs Security Tracker by addressing key limitations in its current CVE–derivation matching pipeline. At present, the system relies on overly permissive substring-based matching, incorrect string-based version comparisons, and lacks proper monitoring, which leads to noisy results, missed vulnerabilities, and silent failures. The proposed work introduces a structured, test-driven redesign of the matching pipeline. It replaces flawed string comparisons with semantic versioning to ensure correct handling of version boundaries. It also improves matching quality by incorporating multiple signals such as trigram similarity, CPE-based matching, and version constraint filtering, thereby reducing noise and increasing the precision of candidate derivations. In addition, the project strengthens data integrity and consistency by fixing cache update issues, eliminating race conditions in issue generation, and ensuring that the system always reflects the latest state after manual or automated changes. It also introduces observability through metrics and dashboards, making system behavior measurable and exposing previously hidden failure cases. Finally, the proposal removes hardcoded infrastructure by enabling dynamic, database-driven channel selection, improving maintainability and scalability. All improvements are guided by measurable metrics and validated through tests to ensure correctness and prevent regressions. Overall, the project aims to deliver a more accurate, robust, and transparent security tracking system for the NixOS ecosystem.