[SECURITY] publish a VEX/VDR

This library might have/had vulnerabilities, see https://github.com/CycloneDX/cyclonedx-javascript-library/security/advisories
and https://github.com/CycloneDX/cyclonedx-javascript-library/issues/1061

We intend to have all security issues closed/fixed eventually, if not already.

We should make this transparent to the user, by publishing a Vulnerability Exploitability eXchange (VEX) documentand and a Vulnerability Disclosure Report (VDR).

Expected outcome:
- publish VEX and VDR - as separate files, at best. if neededd, use Bom-Links to cross-reference.
- files should be in format of CycloneDX 1.6
- the files should be schema-validated as part of the dogfooding-CI
- the files are dynamic (changes over time) - so no intention to ship it in distributing
- files should include a VEX and a VDR -- maybe use dedicated files `{vex,vdr}.cdx.*` , instead of one `security.cdx.*`

for the content, see distinction https://github.com/CycloneDX/bom-examples/blob/master/VDR/README.md#distinction-between-vulnerability-disclosure-report-vdr-and-vulnerability-exploitability-exchange-vex