Move advisories out

I've move the advisories to a standalone repo, so I can also use them in the API to extract the metadata and have /validate/ there.