Add gsm: advisory field in support of issue #305; Added 1 brand new GSM advisory

[jasnow]

Add gsm: advisory field in support of issue #305

• Modified the schemas, specs, and README to add "gsm:" advisory field (similar to "ghsa:" field).
• Add GSM-2016-16 advisory

[postmodern]

What happens when this GSM advisory eventually get's assigned a CVE or added to GitHub Security Advisories DB? Will we end up with a GHSA- and CVE- file? Could the github_advisory_sync.rb automatically rename GSM-* to CVE-*/GHSA-*?

[jasnow]

Good questions

What happens when this GSM advisory eventually get's assigned a CVE or added
to GitHub Security Advisories DB? Will we end up with a GHSA- and CVE- file?

I think that the PR#585 lint check's purpose is to flag duplicate advisories.

Could the github_advisory_sync.rb automatically rename GSM-* to CVE-/GHSA-?

We could watch for it and add a feature when it happens.