As the agency’s vulnerability database buckles under a flood of submissions, it’s planning to shift some responsibilities to other parties.