advisory-match: exclude reviewed false aliases #24296

OSV can expand a CNA's related-advisory link into aliases on every record involved. For slither-analyzer this joined CVE-2026-111171, a later web3 IPv4-mapped IPv6 bypass, to the original CVE-2026-40072, GHSA-5hr4-253g-cpx2 and PYSEC-2026-3414 family, so brew advisory-match added the bypass as an alias of the existing record for the original flaw and implied it was fixed at the same boundary. This adds an excluded_aliases list to formula-and-advisory overrides that drops those alias edges from the named source record, for that formula only, before upstream resolution and grouping. Cached OSV records are copied rather than changed, a record can't exclude its own identifier and alias-only entries create no range override or preserve_homebrew_ranges protection. A further example pins the existing guard that refuses to certify a reviewed introduction from a matching fixed boundary alone.

• [x] Have you followed our Contributing guidelines?


• [x] Have you checked for other open Pull Requests for the same change?


• [x] Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.


• [x] Have you explained why you'd like these changes included, not just what they do?


• [ ] For bug fixes, have you given step-by-step brew commands to reproduce the bug?


• [x] Have you written new tests (excluding integration tests)? Here's an example.


• [x] Have you successfully run brew lgtm (style, typechecking and tests) locally?

• [x] I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Codex (GPT-6 Astra) wrote the change and tests, reproduced the false alias by replaying archived OSV records through the matcher and ran brew lgtm. Separate Codex reviews reran the affected specs, typecheck, style and replays. Claude Code (Opus 5.5) moved the change onto current main, reran the replays and ran brew lgtm --online on this commit.

Summary by CodeRabbit

• 
  Bug Fixes
  
  
  • Improved vulnerability advisory matching so reviewed alias exclusions apply to the relevant formula without changing results for other formulas.
  
  
  • Prevented reviewed advisory history from being certified based solely on a matching fixed boundary.
  
  
  • Tightened validation of advisory alias exclusions, rejecting empty or invalid entries.