Fix condense adding non-critical vulns as critical

This change only affects ```--condense-java```. I am unsure if it should be extended to ```--condense-ms```. The patch would be fairly similar. 

It was noticed when ```--condense-java``` added ~100 hosts because of "Oracle Java JRE Universally Enabled" which had a severity level of None.