Changed AffectedSoftware in Vulnerability to use relationship to CybOX

Also cleaned up a couple cases where we had added relationship list types
but did not extend from GenericRelationshipListType