security/vuxml: remove bogus <cvename/> references

ZDI-CAN-* references are not CVEs. They are internal references from a
security company. CVEs that don't exist upset the vuxmlbuild.