Importing a GitHub advisory fails with a NullPointerException when a vulnerable version range has no patched version

A GitHub security advisory can list an affected package without a patched version, e.g. for a module that was renamed and thus never received the fix, with a range such as >= 3.1-milestone-1, <= 13.3. GitHub's guidelines recommend this form when the upper bound isn't a fixed version. For such an entry, the GitHub API returns "patched_versions": null.

Importing such an advisory (single import page or the scheduled import) fails with:

org.apache.velocity.exception.MethodInvocationException: Invocation of method 'importAndSaveAdvisory' in class org.xwiki.contrib.securityadvisory.script.SecurityAdvisoryScriptService threw exception java.lang.NullPointerException

The cause is GithubAdvisoryDeserializer#getPatchedVersions, which calls Arrays.stream(StringUtils.split(null, ...)). The rest of the application already handles a package without patched versions (e.g. the embargo computation ignores it), so the deserializer should return an empty list in that case.