[FEATURE]: Support multiple analysis element per vulnerability

[ppkarwasz]

Describe the problem

While writing a small proof-of-concept to show how VEX files can help downstream projects discard non exploitable vulnerability reports (copernik-eu/vexation I noticed a limitation of the current CycloneDX spec: each vulnerability object can have only one analysis element.

This means that we can only provide a single justification for all the affects elements, even if each "affects" may have a different justification.

Possible solutions

It might be a good idea to have multiple "analysis" elements and bind each of them with an "affects" element. This could allow to describe situation like:

• a VEX statement says that a CVE is not exploitable in component a, since it is not exploitable in its dependency b. The CycloneDX document could copy the analysis for component b.
• a VEX document could describe multiple versions. Some versions might depend on the vulnerable dependency, other might not. The analysis for each version could be different.