Add OpenVEX matching on local package name + tags

[ferozsalam]

Add local package name and image tag information to the list of identifiers that OpenVEX products are matched against.

Where tags are provided, create a product identifier matching the pURL spec in https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst#oci.

Also add a basic test for the functionality.

Closes #1905

[ferozsalam]

For local testing beyond the unit test, the following vex.json:

{
  "@context": "https://openvex.dev/ns",
  "@id": "https://openvex.dev/docs/example/vex-9fb3463de1b57",
  "author": "Wolfi J Inkinson",
  "role": "Document Creator",
  "timestamp": "2023-01-08T18:02:03.647787998-06:00",
  "version": "1",
  "statements": [
    {
      "vulnerability": "CVE-2023-42363",
      "products": [
        "pkg:oci/busybox?tag=1.36"
      ],
      "status": "not_affected",
      "justification": "blah"
    }
  ]
}

used with go build -o main ./cmd/grype ; ./main busybox:1.36 --vex vex.json

results in 1 ignored vulnerability as desired:

$ go build -o main ./cmd/grype ; ./main busybox:1.36 --vex vex.json                                                                                                  
 ✔ Loaded image                                                                                                                                                busybox:1.36
 ✔ Parsed image                                                                                     sha256:b6bdb81e03b7525b1c21cea8d4b44ccb6bbcd2250a2868debce24fc9709c62db
 ✔ Cataloged contents                                                                                      50f371fd21362e52ae5422b22636bb256c9a1d75ba79c56ff9f6746b44ec7c1e
   ├── ✔ Packages                        [1 packages]
   ├── ✔ File digests                    [1 files]
   ├── ✔ File metadata                   [1 locations]
   └── ✔ Executables                     [11 executables]
 ✔ Scanned for vulnerabilities     [0 vulnerability matches]
   ├── by severity: 0 critical, 0 high, 4 medium, 0 low, 0 negligible
   └── by status:   0 fixed, 4 not-fixed, 1 ignored
NAME     INSTALLED  FIXED-IN  TYPE    VULNERABILITY   SEVERITY
busybox  1.36.1               binary  CVE-2023-42366  Medium
busybox  1.36.1               binary  CVE-2023-42365  Medium
busybox  1.36.1               binary  CVE-2023-42364  Medium