feat: Add config option to enable vex-support for trivy

[hteichmann-strato]

This PR introduces support for Trivy's VEX (Vulnerability Exploitability eXchange) functionality, allowing users to suppress vulnerabilities by setting the new SCANNER_TRIVY_VEX_SOURCE environment variable. This value, which can be "oci" or "repo", is passed directly to Trivy's --vex flag. To ensure a complete implementation, the Helm chart has been updated to expose this setting.

[hteichmann-strato]

Hi @Vad1mo, would it be possible to check the PR? I'm happy to answer any questions.

[reasonerjt]

@hteichmann-strato please sign-off the commit.

[hteichmann-strato]

@reasonerjt yeah, done, pls check it. Sorry for the delay
Update: had use the wrong mail address, fixed.

[hteichmann-strato]

@Vad1mo I accidentally f'ed up the commit sign-off, but that is fixed now and DCO-Bot is happy. Pls let me know if something else is missing. Thanks!

[reasonerjt]

nit: I checked the doc https://trivy.dev/docs/latest/supply-chain/vex/oci/#discover-vex-attestation-in-oci-registry

It seems the user should never set "--vex oci", instead, it should be "--vex oci $image".
Could you update the testcase to avoid confusion?

[hteichmann-strato]

The named argument --vex oci and the seperate positional argument $image are independent and don't need to be adjacent :) so it should be all good.

[reasonerjt]

@hteichmann-strato

1. Could you please check the failure in test?
2. I find there's also a parameter "--skip-vex-repo-update". Does it make sense to also expose this setting along with "--vex"?
3. I also left an inline comment.

[hteichmann-strato]

@reasonerjt done, skip-vex-repo-update is now exposed as well, I don't error on the combination of VEXSource=oci and SkipVEXRepoUpdate=true because trivy also silently ignores this. Happy for any Feedback!