feat(vex): consider root component for relationships

[knqyf263]

Description

This PR is the first step for #6077. The goal is to consider the full dependency graph, but this PR just adds support for the root component. It's specifically useful for container images.

Now, OpenVEX document with subcomponents limitedly works.

{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "author": "Aqua Security",
  "role": "Project Release Bot",
  "timestamp": "2023-01-16T19:07:16.853479631-06:00",
  "version": 1,
  "statements": [
    {
      "vulnerability": {
        "name": "CVE-2022-3715"
      },
      "products": [
        {
          "@id": "pkg:oci/debian",
          "subcomponents": [
            {
              "@id": "pkg:deb/debian/bash"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path"
    }
  ]
}

The following VEX doesn't work.

{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "author": "Aqua Security",
  "role": "Project Release Bot",
  "timestamp": "2023-01-16T19:07:16.853479631-06:00",
  "version": 1,
  "statements": [
    {
      "vulnerability": {
        "name": "CVE-2024-21626"
      },
      "products": [
        {
          "@id": "pkg:golang/github.com/aquasecurity/trivy",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com/opencontainers/runc"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path"
    }
  ]
}

Related issues

• Part of feat(vex): add support for relationships/subcomponents #6077

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[DmitriyLewen]

LGTM