Compute risk score for packages.
See https://github.com/aboutcode-org/vulnerablecode/issues/1543
Pipeline runs older than 60 days are automatically removed. At least the latest 60 pipeline runs are always retained.