Select2 AJAX form, vulndata_by_host and cvss_score fixes

Select2 supports searching content via ajax so this creates a web2py widget to enable it. Currently vulnerability identifiers are used for t_service_vulns.f_vulndata_id:

```
db.t_service_vulns.f_vulndata_id.widget = SQLFORM.widgets.select2autocomplete(
    request, db.t_vulndata.f_vulnid, limitby=(0, 50), min_length=2, id_field=db.t_vulndata.id)
```

Usage is similar to the web2py autocomplete widget but has not been tested without using a linked table (id_field=blah). Also it hard codes span8.

This change also fixes vulns/vulndata_by_host.html and adds a button to create a vulnerability which opens a new tab/window for vulns/vulndata_add. New vulndata should be immediately available in the select2 ajax search.

f_cvss_score was defined with an IS_EMPTY_OR() which permitted it to be blank. This causes errors because we try to cast it with float() or int() and you can't do that with None value. Removed IS_EMPTY_OR() and added validation code for output since you can't always trust the validators.