Code review comment for ~litios/ubuntu-cve-tracker:json-pkg-gen

Hey Eduardo, thanks for the review. I fixed the issues mentioned in a new commit, except some of them:

* I believe there's an alignment issue here.
- This seems to be already in the current code, I just fixed it.

* I believe we can drop the fixed_only argument. It doesn't fit the schema.
- Since this works from the _load function, we could generate the file only with the CVEs that have been fixed instead of all. We are not going to use it in production, but since it works without really touching anything, I didn't see any benefit in removing it. Let me know if you still think we should get rid of it and I will delete it.

* could we just rely on get_pocket and avoid this check?
- Not right now, because the pocket will be either security, release, etc. They want the pocket to be esm-infra/apps if that's where the version is, which is a custom feature for this format. If we migrate that to get_pocket, this will also be the case for regular OVAL.