Consider supporting generic vulnerability scanners

We currently support multiple sources of vulnerability intelligence, among them the NVD, OSS Index, GHSA and VulnDB. In some cases, we perform the actual vulnerability scanning (e.g. NVD, GHSA), in others this is done by the sources themselves (e.g. OSS Index).

There are more great scanning tools out there, like Aqua's [Trivy](https://github.com/aquasecurity/trivy) or Anchore's [Grype](https://github.com/anchore/grype), that we could also integrate with. Trivy will soon support scanning of CycloneDX SBOMs (https://github.com/aquasecurity/trivy/pull/2203), and it already supports VEX output (https://github.com/aquasecurity/trivy/pull/1832).

Given most tools are intended to be invoked via CLI, integration with DT may require a thin web API layer that exposes the functionality via REST or gRPC.

Instead of hardcoding integrations in DT, we could allow for configuration of generic scanners that accept CycloneDX SBOMs and return CycloneDX VEX documents. Users could then decide to only rely on Trivy, or any other arbitrary combination of scanners.

Supporting tools like Trivy may also be beneficial for environments that are not supposed to have direct internet access (https://aquasecurity.github.io/trivy/v0.28.1/docs/advanced/air-gap/).