Code review comment for ~alexmurray/ubuntu-cve-tracker:package-db-json-validation

Although I am starting to think the current package-db.json is perhaps insufficient for our needs - maybe the idea of combining package_info_overrides.json with this was not such a great idea since now that I think about it, we are kind of talking about 2 different things. I think maybe I'll schedule a meeting to talk this over with some folks and let's see if we can come up with something more workable.