Create three-state indicator whether a vuln is-fixed, not-fixed, or unknown-fixed.
RFE-4446 Allow to exclude CVEs without remediation from triggering a notification