Add a cpe to 4 rules whose product NVD lists under an identity they never carried

[rvw]

Summary

Follow-up to #511. These 4 rules detect a real, identifiable product, but have never carried a cpe at all — so no CVE data has ever been reachable through them. Each now gets the identity NVD actually files that product's CVEs under.

Rule	Detects	New cpe	Why this identity
MailChimp for WordPress (m.json)	the mailchimp-for-wp WordPress plugin (its wp-content/plugins path, the mc4wp JS global)	a:ibericode:mailchimp	NVD files this plugin's CVEs (4, 142 dictionary names from 2.2 to 4.9.17) under ibericode:mailchimp.
Progress MOVEit (p.json)	MOVEit Transfer: the X-Moveitisapi-Version header and Transfer's own mobile app IDs (meta.apple-itunes-app / google-play-app)	a:progress:moveit_transfer	NVD files Transfer's CVEs, including CVE-2023-34362 and CVE-2024-5806, under progress:moveit_transfer.
Divi (d.json)	the Divi WordPress theme/plugin (requires: WordPress, the Divi/js/custom.js path)	a:elegantthemes:divi	NVD's dictionary has two similarly-named entries: elegantthemes:divi (7 CVEs) and elegant_themes:divi (0). Current Divi CVEs are under the former.
UniFi OS (u.json)	unifiConstant.VERSION, which the UniFi Network Application's web UI sets	a:ui:unifi_network_application	NVD files the Network Application's CVEs (9, 73 dictionary names from 6.2.23 to 10.5.54) under this identity. o:ui:unifi_os names the consoles' own operating system, a different product this rule doesn't read.

Why Mixpanel isn't here

Mixpanel also has no cpe, but — unlike the four above — there's no identity to give it: NVD's dictionary has exactly one mixpanel product, mixpanel_project:mixpanel, and it's an unrelated Drupal module (one CVE, CVE-2012-5585, a stored-XSS issue in that module's 6.x-1.x branch). Mixpanel's own browser SDK, which this rule actually detects (cdn.mxpnl.com/libs/mixpanel-*.min.js), has no NVD product at all. Assigning the Drupal module's identity here would be wrong in the same way #511 fixed elsewhere, so it's left CPE-less.

Verification

Same validators as #511, run locally against every changed file:

• structure_validator.py, order_validator.py, schema_validator.py, category_validator.py, group_validator.py, icon_path_validator.py — pass
• technology_validator.py for m, p, d, u — pass (each cpe matches the validator's CPE 2.3 pattern)
• All 4 changed files parse as valid JSON; no other field touched

🤖 Generated with Claude Code