Please address the comments from this code review:

## Overall Comments
- Consider returning a copy of `AllSeverities` from a helper (e.g. `DefaultSeverities() []string`) instead of exposing a mutable package-level slice, to avoid accidental modification by callers.
- The `cveSeverityFromString` function silently maps unknown severity strings to `LowCVESeverity`; consider returning an error or a boolean flag instead so unexpected inputs don’t get coerced without visibility.

## Individual Comments

### Comment 1
<location> `roxctl/common/scan/cve.go:25-34` </location>
<code_context>
 )

-func (c cveSeverity) String() string {
+var (
+	AllSeverities = []string{
+		LowCVESeverity.String(),
+		ModerateCVESeverity.String(),
</code_context>

<issue_to_address>
**suggestion (bug_risk):** AllSeverities being a mutable exported slice can be modified by callers and desynchronize validation logic.

External packages can currently append, remove, or reorder entries, which may cause Validate and other logic relying on the original set/order to behave incorrectly at runtime. Consider returning a copy via an accessor (e.g. `AllSeverities() []string`) or making the slice unexported and exposing a controlled API so supported severities remain immutable.

```suggestion
var (
	allSeverities = []string{
		LowCVESeverity.String(),
		ModerateCVESeverity.String(),
		ImportantCVESeverity.String(),
		CriticalCVESeverity.String(),
	}
)

// AllSeverities returns a copy of the supported CVE severity labels.
// Callers can safely use and modify the returned slice without affecting
// the internal canonical list.
func AllSeverities() []string {
	out := make([]string, len(allSeverities))
	copy(out, allSeverities)
	return out
}

type CVESeverity int
```
</issue_to_address>