VEX Tool: First Commit

[puerco]

This PR is the initial commit of code of the VEX tool. This initial version supports:

• Parsing SARIF results. Tested with Trivy and Grype results
• Reading VEX data from our internal format
• Reading VEX data from CSAF documents
• Filtering scanner results using cmd vex results.sarif.json rules.vex.json

Signed-off-by: Adolfo García Veytia (Puerco) puerco@chainguard.dev

[puerco]

I've addressed @cpanato 's nits. Thanks!