Give the possibility to atomically upload a SBOM with related VEX

### Current Behavior:

Dependency Track manage BOM and VEX as distinct entities with their own API as recommended [here](https://cyclonedx.org/capabilities/vex/).
From an automation perspective, one has to :
- Upload a BOM with /v1/bom API and get a token
- Wait for BOM to be completely processed and fetch project/component identifiers
- Eventually alter VEX with the proper bom-refs and upload it with /v1/vex and get a token
- Check that VEX is completely processed

### Proposed Behavior:

Provide the ability to manage BOM and VEX atomically to ease integration tasks. Two alternatives (not mutually exclusive)

1. Distinct resources : Enhance POST|PUT /v1/bom API with an optional `vex` field and chain `BomUploadEvent` and `VexUploadEvent` events during the BOM processing
2. Mutualized resource : During BOM upload processing, check if the BOM has vulnerabilities and if the test is positive, handle the VEX upload as part of the processing