npm / arborist / #12

push

Fix case where dep vuln also has an advisory

This preserves the information that was previously being thrown aside,
where a node that is vulnerable by virtue of having a dependency on a
vulnerable module *also* has an advisory posted against it.

Prior to this commit, the dep vuln would be lost.

Also, more importantly, the calculation for upgrading severity was
completely backwards, which could result in vulnerabilities being
reported at a lower level then they should have been in these cases.

1717 of 1717 branches covered (100.0%)

Branch coverage included in aggregate %.

6 of 6 new or added lines in 1 file covered. (100.0%)

2589 of 2589 relevant lines covered (100.0%)

228.46 hits per line