Add VEX File Validation Tool with Status Transition Validation and lib4vex Integration

Overview

This PR implements a comprehensive VEX (Vulnerability Exploitability Exchange) file validation tool that addresses the need for robust VEX file validation and editing support as outlined in the GSoC 2025 project requirements.

Key Features Implemented

Multi-format VEX Validation

• CycloneDX: Leverages lib4sbom validator (v0.8.6+) for schema validation (recommended by @anthonyharrison)
• CSAF: JSON schema validation with format-specific requirements
• OpenVEX: JSON schema validation with semantic checks

Status Transition Validation

• Detects invalid status transitions (e.g., marking a CVE as "not_affected" without proper justification)
• Validates that CycloneDX "not_affected" states include analysis.detail field
• Validates that OpenVEX "not_affected" statements include action_statement field
• Prevents common VEX authoring mistakes that could lead to incorrect vulnerability assessments

lib4vex Integration for Actionable Fixes

• Integrates lib4vex parser for advanced vulnerability analysis
• Provides specific, actionable error messages with exact syntax suggestions
• Examples: "Add missing timestamp field: 'timestamp': '2024-01-01T00:00:00'"
• Suggests missing author information and metadata improvements

Architectural Improvements

• lib4sbom Integration: Updated dependency from v0.7.2 to v0.8.6+ to access validation functionality
• Consistent Validation: CycloneDX VEX validation now uses the same proven validation logic as SBOM validation
• Future-proof: Automatically benefits from lib4sbom validation improvements

CLI Usage

# Validate a VEX file
cve-bin-tool vex-validate --vex-file-to-validate my-vex-file.json

# Alternative syntax
cve-bin-tool my-vex-file.json vex-validate

# Offline validation (no schema downloads)
cve-bin-tool vex-validate --vex-file-to-validate my-vex-file.json --offline