Fix/84 preserve fix links

[atomicturtle]

Closes issue #84

Ingest dropped Jira fix references (RHEL-* / issues.redhat.com) from document.references, so cloned RLSAs only retained Bugzilla tickets.

This change:

• Collects Bugzilla + Jira ticket ids from CSAF vulnerability ids/refs and document.references
• Maps each ticket id to the correct source URL (bugzilla.redhat.com vs issues.redhat.com)
• Uses that URL when creating AdvisoryFix rows on Rocky clones
• Rejects non-numeric values mislabeled as “Red Hat Bugzilla ID”
• Does not invent Bugzilla URLs for unrecognized ticket ids

[rockythorn]

Review: Request changes (one blocking issue)

CSAF parsing tests pass (test_rhcsaf). Fix link collection logic is correct.

What works

• fix_source_url() correctly routes Bugzilla numeric IDs to bugzilla.redhat.com and Jira keys (RHEL-, OCPBUGS-) to issues.redhat.com. Returns empty string for unrecognized IDs — good, doesn't invent URLs.
• _ticket_id_from_reference() extracts ticket IDs from both summary text and URL parsing. Handles URL-only Jira refs.
• _collect_fix_ticket_ids() consolidates tickets from vulnerability.ids[], vulnerability.references[], and document.references[].
• Non-numeric Bugzilla IDs correctly rejected (CVE strings, URLs, whitespace).
• Tests are thorough with good edge cases.

Blocking issue

test_rh_matcher_activities fails with ModuleNotFoundError: No module named 'apollo.rhcsaf'.

The PR adds from apollo.rhcsaf import fix_source_url to rh_matcher_activities.py, but the rpmworker Bazel target doesn't depend on rhcsaf. Add to apollo/rpmworker/BUILD.bazel:

deps = [
    ...
    "//apollo/rhcsaf:rhcsaf_lib",
]

[atomicturtle]

Addressed the Bazel miss: rpmworker_lib now depends on //apollo/rhcsaf:rhcsaf_lib, and this branch is merged with current main.

This stays scoped to CSAF fix-link ingest for review. It is not a production Apollo cutover change.