fix(fp): suppress FP from grpc-go; migrating grpc CVE-by-CVE suppressions to hosted suppressions

[chadlwilson]

Description of Change

Migrates the GRPC CVE-by-CVE suppressions to hosted for easier maintenance; and suppresses additional vuln CVE-2026-33186 (another grpc-go CVE)

For reference:

DependencyCheck/core/src/main/resources/dependencycheck-base-suppression.xml

Lines 282 to 301 in 5b8a493

	<suppress base="true">
	<notes><![CDATA[
	FP per #3002 and #5890 - CVE are for GRPC C/ruby/python etc. Suppressing individual CVEs because ODC cannot understand the target SW
	field. NVD search to review in future (not that some are marked incorrectly as affecting all languages)
	--> https://nvd.nist.gov/vuln/search#/nvd/home?sortOrder=1&sortDirection=1&cpeFilterMode=applicability&cpeName=cpe:2.3:a:grpc:grpc:*:*:*:*:*:*:*:*&resultType=records
	]]></notes>
	<packageUrl regex="true">^pkg:maven/io\.grpc/grpc\-.*$</packageUrl>
	<cve>CVE-2017-7860</cve>
	<cve>CVE-2017-7861</cve>
	<cve>CVE-2017-8359</cve>
	<cve>CVE-2017-9431</cve>
	<cve>CVE-2020-7768</cve>
	<cve>CVE-2023-1428</cve>
	<cve>CVE-2023-32731</cve>
	<cve>CVE-2023-32732</cve>
	<cve>CVE-2023-33953</cve>
	<cve>CVE-2023-4785</cve>
	<cve>CVE-2024-11407</cve>
	<cve>CVE-2024-7246</cve>
	</suppress>

Related issues

• fixes [FP]: gRPC-Go server CVE-2026-33186 reported against Java libraries #8503

Have test cases been added to cover the new functionality?

N/A

[nhumblot]

Thank you for your help!

[chadlwilson]

Thanks! Could you please manually trigger the publish suppressions workflow so this is visible to users?

https://github.com/dependency-check/DependencyCheck/actions/workflows/publish-suppressions.yml

We haven't got this workflow auto-triggering on the branch update just yet - it only runs via the automated approval workflow at the moment (been meaning to submit a PR for that).

I've also marked the cleanup PRs as ok to review/merge (removed the duplicate rules from base suppressions that this PR creates, since these two sets of suppressions are essentially aggregated together for every install now)