If CNA chooses to use CWE for `problemTypes`, require `cweId`

[zmanion]

problemTypes and CWE are recommended, but not required.

If type is 'CWE' then require cweId and test the value with a reasonable regex (something like ^CWE-[0-9]{2,5}).

[zmanion]

An example, CVE-2024-9428:

[
  {
    "descriptions": [
      {
        "description": "CWE-79 Cross-Site Scripting (XSS)",
        "lang": "en",
        "type": "CWE"
      }
    ]
  }
]

List of some other malformed records attached, mostly from WPScan.

[zmanion]

See also CVEProject/cve-schema#384.