Clarify sentence about "last_affected" and "fixed" in docs.

[tiegz]

From the docs:

Entries in the events array can contain either "last_affected" or "fixed" events, but not both.

This line could be referring to either of these events arrays:

{
  "events": [
    {"introduced": "0.0.0"},
    {"last_affected": "1.0.0", "fixed": "1.0.1"}
  ]
}

{
  "events": [
    {"introduced": "0.0.0"},
    {"last_affected": "1.0.0"},
    {"fixed": "1.0.1"}
  ]
}

The first one is invalid because it has an Object that contains two entries, but that is covered by this line from the docs:

Only a single type (either introduced, fixed, last_affected, limit) is allowed in each event object.

And according to this comment I think the latter invalid case is the one that is being referred to: #146 (comment)

So I suggest changing the wording to be more specific:

An events array can have entries containing either "last_affected" or "fixed" events, but not both.

[andrewpollock]

Yes, there's some semantic nuance here, which is a little tricky to convey, I think.

So to get all JSON-technical, the events array is an array of JSON (event) objects, and the intention of the statement under scrutiny is to refer to these event objects, as you've surmised.

https://github.com/ossf/osv-schema/blob/main/validation/schema.json#L92-L150

Suggested change

	An events array can have entries containing either "last_affected" or "fixed" events,
	Entries in the `events` array may be "last_affected" or "fixed" events,

[tiegz]

@andrewpollock I think that it's possible that someone may still misread that suggestion as disallowing this case:

[..., {"last_affected": "1.0.0", "fixed": "1.0.1"}, ...]