NVD importer migration followups

[TG1999]

@pombredanne I am starting this issue to track your comments in #664

• Originally posted by @pombredanne in Migrate nvd importer to importer-improver model #664 (comment)

Why do you remove the CVEs from references?
We still want them there IMHO ... in particular that's where we would get the severity score from the NVD?

• Originally posted by @pombredanne in Migrate nvd importer to importer-improver model #664 (comment)

You are returning a set not a list. Should your return a sorted list then? Why using a set?

• Originally posted by @pombredanne in Migrate nvd importer to importer-improver model #664 (comment)

It could make sense to:

1. extract the function to check if a single CVE is related to hardware
2. have a set of tests for this that would be easier to read including explicit tests with CPE 2.2 and 2.3 that are hardware or not.

How many types of CPEs is there beyond hardware?