Make CVE (`vulnerabilities`) in scanned SBOMs available inside DevGuard

[knoobie]

Is your feature request related to a problem? Please describe.
SBOM created by external software or customer can contain the property vulnerabilities. This information is lost when importing the SBOM into Devguard.

Describe the solution you'd like
vulnerabilities is scanned and included in the vulnerabilies inside Devguard.

Context:

• CycloneDX Spec: https://cyclonedx.org/docs/1.7/json/#vulnerabilities
• Devguard might not "find" all vulnerabilities if the "CVE data is wrong" - some external tools can find "more" Critical Tomcat CVE not detected #2597