[PATCH 4/6] refine verify-references to deal only with OVAL compliance checks for OVAL