internal/cveschema: use actual state strings

Change the strings for the CVE_data_meta.STATE field to match the
actual values in the repo, not the ones in
https://cve.mitre.org/about/terminology.html#cve_record.

Change-Id: I7e1e027f601e2c1837ac9dba311e9898e34a15f9
Reviewed-on: https://go-review.googlesource.com/c/vuln/+/362019
Trust: Jonathan Amsterdam <jba@google.com>
Run-TryBot: Jonathan Amsterdam <jba@google.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Julie Qiu <julie@golang.org>
diff --git a/internal/cveschema/cveschema.go b/internal/cveschema/cveschema.go
index 85fb4ed..9ef8d63 100644
--- a/internal/cveschema/cveschema.go
+++ b/internal/cveschema/cveschema.go
@@ -15,13 +15,13 @@
 	// as a CVE Record, the state of the CVE Record is Published. The
 	// associated data must contain an identification number (CVE ID), a prose
 	// description, and at least one public reference.
-	StatePublished = "PUBLISHED"
+	StatePublished = "PUBLIC"
 
 	// StateRejected is when the CVE ID and associated CVE Record should no
 	// longer be used, the CVE Record is placed in the Rejected state. A Rejected
 	// CVE Record remains on the CVE List so that users can know when it is
 	// invalid.
-	StateRejected = "REJECTED"
+	StateRejected = "REJECT"
 )
 
 // CVE represents a "Common Vulnerabilities and Exposures" record, which is