cve-update-db-native: Allow to overrule the URL in a bbappend.

With this small patch, it's possible to overrule the public
URL with a local mirror for those without Internet access.

Signed-off-by: Jan Vermaete <jan.vermaete@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 2d903126)
Signed-off-by: Steve Sakoman <steve@sakoman.com>