package/newlib-bare-metal: add CPE variables

cpe:2.3:a:newlib_project:newlib is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/detail/822D4AAB-314B-4148-BE10-FCC59D1649BD

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/newlib-bare-metal/newlib-bare-metal.mk

@@ -15,6 +15,8 @@ NEWLIB_BARE_METAL_LICENSE_FILES = \
 	COPYING.LIB \
 	COPYING.LIBGLOSS \
 	COPYING.NEWLIB
+NEWLIB_BARE_METAL_CPE_ID_VENDOR = newlib_project
+NEWLIB_BARE_METAL_CPE_ID_PRODUCT = newlib
 
 NEWLIB_BARE_METAL_INSTALL_STAGING = YES
 NEWLIB_BARE_METAL_INSTALL_TARGET = NO