[FEATURE]: Support multiple `analysis` element per `vulnerability`

## Describe the problem

While writing a small proof-of-concept to show how VEX files can help downstream projects discard non exploitable vulnerability reports ([copernik-eu/vexation](https://github.com/copernik-eu/vexation/) I noticed a limitation of the current CycloneDX spec: each [`vulnerability`](https://cyclonedx.org/docs/1.6/json/#vulnerabilities) object can have only **one** [`analysis`](https://cyclonedx.org/docs/1.6/json/#vulnerabilities_items_analysis) element.

This means that we can only provide a single justification for all the [`affects`](https://cyclonedx.org/docs/1.6/json/#vulnerabilities_items_affects) elements, even if each "affects" may have a different justification.

## Possible solutions

It might be a good idea to have multiple "analysis" elements and bind each of them with an "affects" element. This could allow to describe situation like:

- a VEX statement says that a CVE is not exploitable in component `a`, since it is not exploitable in its dependency `b`. The CycloneDX document could copy the analysis for component `b`.
- a VEX document could describe multiple versions. Some versions might depend on the vulnerable dependency, other might not. The analysis for each version could be different.