internal/worker: store CVE on mod

When a CVERecord is modified because it now needs an issue,
store the CVE with the record.

Change-Id: I783df5edee508c1dd19efb5afaafb4268cb26e66
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/376996
Trust: Jonathan Amsterdam <jba@google.com>
Run-TryBot: Jonathan Amsterdam <jba@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Damien Neil <dneil@google.com>
diff --git a/internal/worker/update.go b/internal/worker/update.go
index f2bebd0..7433be1 100644
--- a/internal/worker/update.go
+++ b/internal/worker/update.go
@@ -298,6 +298,7 @@
 			mod.Module = result.modulePath
 			mod.Package = result.packagePath
 			mod.TriageStateReason = result.reason
+			mod.CVE = cve
 		}
 		// Else don't change the triage state, but we still want
 		// to update the other changed fields.