Handle sev/cvss with None without erroring and remove IS_EMPTY_OR for f_cvss_score

f_cvss_score and f_severity fields for db.t_vulndata should always be something,
however f_cvss_score was configured with IS_EMPTY_OR() which meant it could be None.
This throws errors because we force casts in some parts of the code and you can't
do that with None.
Adds a Select2 AJAX-based widget, working for vulndata

Select2 supports searching content via ajax so this creates a web2py
widget to enable it. Currently vulnerability identifiers are used
for t_service_vulns.f_vulndata_id:

```
db.t_service_vulns.f_vulndata_id.widget = SQLFORM.widgets.select2autocomplete(
    request, db.t_vulndata.f_vulnid, limitby=(0, 50), min_length=2, id_field=db.t_vulndata.id)
```

Usage is similar to the web2py autocomplete widget but has not been
tested without using a linked table (id_field=blah). Also it hard codes
span8.

This change also fixes vulns/vulndata_by_host.html and adds a button
to create a vulnerability which opens a new tab/window for
vulns/vulndata_add. New vulndata should be immediately available
in the select2 ajax search.
Merge pull request #137 from grutz/select2_json

Select2 AJAX form, vulndata_by_host and cvss_score fixes