Add crate-features to advisory "ecosystem-specific" metadata

[BatmanAoD]

Some advisories are only relevant when specific crate features are enabled. For instance, https://rustsec.org/advisories/RUSTSEC-2026-0365.html says that the advisory is only relevant when the std feature is enabled.

As far as I can tell, advisory-db advisories do not have a way to record the feature(s) that must be enabled for the advisory to apply. This information could go under the ecosystem_specific key in the OSV schema.

cargo-deny and related tools could then suppress advisories for crates that are affected but do not have the relevant feature(s) enabled in the analyzed build configurations.

[djc]

Sounds okay, I guess? Not sure I have a lot of time/motivation to work on this soon, but would be able to review a straightforward PR.