merge-cve-files: fix crash when there's an experimental tag

If CVE/list has a CVE such as:

CVE-2023-1234
	[experimental] - foo 1.0-1
	- foo 1.0-2

And we attempt to fix an annotation such as

CVE-2023-1234
	[bullseye] - foo 0.1-1+deb11u1

that will crash when we are iterating over the experimental annotation
as next_annotation would be the sid one with release==None, and we would
be comparing internRelease(bullseye) with internRelease(None), which
is not supported.

This is happening with the current data/next-point-update.txt

1 files changed, 7 insertions, 0 deletions

diff --git a/bin/merge-cve-files b/bin/merge-cve-files
index 36dee7acd5..b5382aa6fb 100755
--- a/bin/merge-cve-files
+++ b/bin/merge-cve-files
@@ -87,6 +87,13 @@ def merge_annotations(annotations, new_annotation):
             annotations[idx] = new_annotation
             break
 
+        # if we found an experimental annotation, it will be followed by a 'sid'
+        # one, so next_annotation.release will be None in the next case. That
+        # comparison will break, so we avoid it by continuing. If new_annotation
+        # was for experimental, we would have already replaced it in the above check.
+        if annotation.release == 'experimental':
+            continue
+
         # if the next annotation's release is the same, we continue to replace
         # it in the next iteration. otherwise if we found the right place, we
         # insert the new annotation