Logic Enhancement within Policy Creation

### Current Behavior

In the image above we are trying to write a policy that "FAILs", if these conditions exist. Our goal is to make RULE this applicable across all projects.

"IS" "Critical

OR

"IS" "High"

OR

"IS NOT" "CVE-2018-2225"

It appears we cannot do this because the "Vulnerability ID" "CVE-2018-20225" is "Critical" also.

### Proposed Behavior

Can we add a feature that adds more granularity to the "Vulnerability ID"?

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

This requests finer-grained policy conditions on Vulnerability ID in Dependency-Track's policy engine — the current operator set cannot express the proposed OR combination. Start by reading the policy condition model and evaluation code (the policy engine package under src/main/java/org/dependencytrack/policy) to see how conditions and operators are defined for vulnerability attributes. No maintainer response or linked PR exists, so scope and design would first need maintainer input; 'done' is new operators or condition granularity supported by policy evaluation tests.

Written by the indexing model from the issue text.