VEX documents (including OpenVEX) and .trivyignore are ignored during SBOM ingestion and re-analysis

### Current Behavior

Dependency-Track currently ignores both .trivyignore-based suppressions and externally attached VEX documents (e.g., OpenVEX) during SBOM ingestion and re-analysis.

We have automated pipelines that generate SBOMs using Trivy. While Trivy allows suppressions via .trivyignore, those suppressed CVEs still appear in Dependency-Track once the SBOM is uploaded. Additionally, we attempted to use OpenVEX (via vexctl) to attach a VEX document to the SBOM before pushing it to Dependency-Track, but those suppressions are also ignored.

When we attempt to upload an OpenVEX document directly to Dependency-Track via the “Apply VEX” feature, the upload fails due to schema validation issues. However, if we manually pull the VEX document from Dependency-Track, modify it to match the internal schema format (adding not_affected entries for desired CVEs), and re-upload, it successfully applies and hides the suppressed CVEs as expected.

While this proves that suppression via VEX technically works, it's not viable for automated pipelines, as it would require:

- Uploading the BOM
- Downloading the generated VEX
- Programmatically modifying it
- Re-uploading it

This is not scalable in CI/CD environments, especially when pipelines run daily and BOMs are constantly refreshed.

### Steps to Reproduce

- [ ] 1. Create a Trivy-generated SBOM and suppress one or more CVEs using .trivyignore.
- [ ] 2. Upload the SBOM to a Dependency-Track project.
- [ ] 3. Observe that the CVEs marked to be ignored still appear.
- [ ] 4. Create a VEX document using vexctl (OpenVEX format) containing not_affected entries for the same CVEs.
- [ ] 5. Attach the VEX to the SBOM or upload it separately using the “Apply VEX” feature.
- [ ] 6. Observe that the VEX is either ignored or rejected due to schema mismatch.
- [ ] 7. Manually download the VEX report from the same project, edit it in-place to match DT’s expected schema, and upload it back — now suppression works.

### Expected Behavior

Dependency-Track should:

- Respect .trivyignore suppressions during SBOM ingestion.

- Accept and apply external VEX documents such as OpenVEX (especially when compliant with the CycloneDX VEX 1.0 spec).

- Allow automated suppression flows during SBOM push, without requiring manual VEX patching post-upload.

- Optionally support global VEX or suppression lists, allowing teams to centrally manage suppressions (e.g., from a shared artifact or registry) across all projects and pipeline executions.

Possible references:

- [#3554](https://github.com/DependencyTrack/dependency-track/issues/3554) Export and Import VEX fails to match Vulnerabilities correctly
- [#1921](https://github.com/DependencyTrack/dependency-track/discussions/1921) Help needed for BOM-VEX link

### Dependency-Track Version

4.13.0

### Dependency-Track Distribution

Container Image

### Database Server

N/A

### Database Server Version

_No response_

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported