Ability to specify commenter when importing CycloneDX VEX

### Current Behavior

When a CycloneDX VEX file is uploaded to Dependency Track, the audit trail entry created for each affected vulnerability uses the hardcoded string `"CycloneDX VEX"` as the commenter, regardless of any authorship information present in the VEX file:

```java
// CycloneDXVexImporter.java
private static final String COMMENTER = "CycloneDX VEX";
```

This means all VEX-imported audit trail entries look identical in the UI:

```
CycloneDX VEX - 15 Jun 2026 at 17:27:03
Details: The heap over-read affects only applications that call inflateGetHeader...
```

There is no way to distinguish who performed the vulnerability analysis, even when that information is present in the uploaded file.

If you do the analysis manually through the DT UI the user name will be used.

### Proposed Behavior

Two solutions are proposed. Either or both could be implemented.

---

#### Solution A — Read `metadata.authors` from the VEX file

The CycloneDX specification includes a `metadata.authors` field explicitly designed for human-authored documents:

> *"The person(s) who created the BOM. Authors are common in BOMs created through manual processes."*

When a VEX file is uploaded, `CycloneDXVexImporter` should check whether `bom.metadata.authors` is populated. If one or more authors are present, their names should be used as the commenter in the audit trail entry instead of the hardcoded fallback. If multiple authors are listed, they should be concatenated (e.g. `"Alice Smith, Bob Jones"`). If no authors are present, the current fallback of `"CycloneDX VEX"` should be retained to preserve backward compatibility.

**Example — VEX file with author:**
```json
{
"bomFormat": "CycloneDX",
"specVersion": "1.5",
"metadata": {
"authors": [
{ "name": "Alice Smith" }
]
},
"vulnerabilities": [ ... ]
}
```

**Resulting audit trail entry:**
```
Alice Smith - 15 Jun 2026 at 17:27:03
Details: The heap over-read affects only applications that call inflateGetHeader...
```

**Fallback (no `metadata.authors` present):**
```
CycloneDX VEX - 15 Jun 2026 at 17:27:03
Details: ...
```

This change requires a minimal, low-risk modification to `CycloneDXVexImporter.applyVex()` — the `Bom` object is already available at that point, so no additional parsing or API changes are needed.

---

#### Solution B — Optional `author` parameter on the VEX upload API

The VEX upload endpoint (`PUT /api/v1/vex/cyclonedx/project/{uuid}`) should accept an optional `author` query or form parameter. When provided, this value is passed through to `CycloneDXVexImporter` and used as the commenter in all audit trail entries created during that upload. This gives API callers and CI/CD pipelines full control over the commenter without needing to embed authorship inside the VEX file itself.

**Example — API call with author parameter:**
```
PUT /api/v1/vex/cyclonedx/project/8a4a1b2c-...
?author=Alice+Smith
```

**Fallback (parameter omitted):**
```
CycloneDX VEX - 15 Jun 2026 at 17:27:03
Details: ...
```

If both Solution A and Solution B are implemented, Solution B (the explicit API parameter) should take precedence over `metadata.authors`, which in turn takes precedence over the hardcoded fallback.

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Start with CycloneDXVexImporter.applyVex() and trace the VEX upload endpoint PUT /api/v1/vex/cyclonedx/project/{uuid}. Compare the two proposed authorship sources and determine how the importer and endpoint currently pass commenter information. Done means audit entries use the requested precedence and retain the CycloneDX VEX fallback when no author is available.

Written by the indexing model from the issue text.