nix: add a CPE for hey-cli
DA
2d ago+3+3+0123456789-0-0-0123456789
adding this helps avoid confusion when scanning for CVEs affecting the system
currently sbomnix reports
CVE-2018-13730 is for cpe:2.3:a:hey_project:hey:-:::::::* that has nothing to do with hey-cli.
Adding a correct cpe would remove this false positive
Summary by cubic
Fixes false-positive CVE reports for hey-cli by adding the correct CPE identifier to the Nix package metadata.
Without it, vulnerability scanners match hey-cli against the unrelated CVE-2018-13730, which targets hey_project:hey. The new CPE identifies the package as basecamp:hey-cli, so scans no longer flag this unrelated advisory.