Whitelist handling broken

[ckauhaus]

vulnix whitelisting feature is broken in the sense that there are too many matching errors and the syntax is hard to get right.

Ideas:

• switch to TOML (keep YAML parser for compatibility)
• allow wildcard matches in package names and versions
• introduce issue and until fields

Migrated from FCIO internal bug https://fb.flyingcircus.io/f/cases/29313/

[ckauhaus]

done