Add VEX as a property under security-artifacts

[Danajoyluck]

when a project generates VEX feed for vulnerabilities that are not exploitable, SECURITY_INSIGHTS.yml is an ideal place to capture this information. The work around is to add VEX statement information under “security-artifacts” > “other-artifacts”.

Having VEX as an explicit property will make it a deterministic property for policy engines to pick it up and make decisions during software ingestion or scanners to reduce false positives.

[puerco]

We're defining a well known location in the repositories, the location could default to whatever resolves this issue:

openvex/spec#46

[eddie-knight]

I've drafted this in #96:

project:
  release:
    latest:
      provenance:
        vex-data: https://foo.bar/vex

[eddie-knight]

Thanks for this suggestion @Danajoyluck!

As per a design proposed by @puerco, support for vex is implicit within the attestation objects that will be included in the upcoming release (#97)