Make vulnerabilities links

## Feature Request: Render Vulnerability URLs as Clickable Links

### Problem

When vulnerability information from a CycloneDX SBOM is displayed, the vulnerability URLs are currently rendered as plain text.

For example, a vulnerability contains a source URL such as:

```json
"source": {
"name": "github-language-dotnet",
"url": "https://github.com/advisories/GHSA-6xh7-4v2w-36q6"
}
```

It may also contain additional URLs in the `references` and `advisories` collections.

Users must currently copy and paste these URLs into a browser to view the corresponding advisory.

### Requested Behavior

Render vulnerability URLs as clickable hyperlinks wherever they are displayed.

At minimum, the following fields should be linked:

* `vulnerabilities[].source.url`
* `vulnerabilities[].references[].source.url`
* `vulnerabilities[].advisories[].url`

When a vulnerability ID is displayed, such as `GHSA-6xh7-4v2w-36q6`, the ID could use `vulnerabilities[].source.url` as its hyperlink rather than displaying the full URL separately.

### Example

Instead of displaying:

```text
GHSA-6xh7-4v2w-36q6
https://github.com/advisories/GHSA-6xh7-4v2w-36q6
```

Display the vulnerability ID as a link:

```markdown
[GHSA-6xh7-4v2w-36q6](https://github.com/advisories/GHSA-6xh7-4v2w-36q6)
```

Additional advisory links should also be clickable.

### Acceptance Criteria

* Valid HTTP and HTTPS vulnerability URLs are rendered as hyperlinks.
* Clicking a vulnerability ID opens its primary source URL.
* URLs in the `references` and `advisories` collections are also clickable.
* Links open in a new browser tab or window.
* Link text clearly identifies the advisory, preferably using the vulnerability or advisory ID.
* Malformed or unsupported URLs continue to display safely as plain text.
* URLs and link text are HTML-encoded to prevent injection vulnerabilities.

Start by locating the vulnerability rendering entry point and the code that displays source, reference, and advisory URLs. Trace how vulnerability IDs and URLs are currently output, then verify valid links, safe handling of malformed URLs, HTML encoding, and new-tab behavior against the acceptance criteria.

Written by the indexing model from the issue text.