Understanding the Reproducibility of Crowd-reported Security Vulnerabilities