Parsing BOM with embedded VEX

### Current Behavior

DependencyTrack currently has two APIs to upload BOM and VEX files.

### Proposed Behavior

We currently create CycloneDX BOMs for a yocto-linux project - but yocto also provides a list of "fixed CVEs".
When uploading to DependencyTrack, we now first upload the BOM, then wait for vulnerability analysis - and THEN upload a VEX-file containing the fixed CVE information.
As both are CycloneDX, they can be combined into one file (like we can download "BOM with Vulnerabilities") - and we would like to upload them as "BOM with vulnerability analysis".

Currently the BOM ingression seems to ignore the analysis part provided in the vulnerabilities section. I would propose to extend the BOM ingression to also parse the vulnerabilies section - and most importantly the "analysis" part of that to make it a one-shot action (and not make the build pipeline wait and upload it as two files).

(While we're at it: Why shouldn't "Inventory with Vulnerabilities" also include the analysis part?)

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested