handle cases where CVE data are absent

tinfoilhat collects vendor, product name, version etc. from each recipe in order to enable continuous CVE check on aliensrc packages (not implemented yet). However such data are available only if the cve-check task is run when building the images.

We should also handle cases in which, for whatever reason, cve-check has not been run by bitbake and such data are absent