Taking a cue from RubySec, this splits the original "versions" attribute into
separate ones for versions which were never vulnerable, and ones which include
an explicit fix for a vulnerability.
This is using the TOML format described in the (presently open) initial RustSec
RFC for security advisories described here:
https://github.com/RustSec/rfcs/pull/1