Move from openvex-go to cyclonedx-go

OpenVex specification doesn't have a good way to express state / justification for cases when the platform blocks the vulnerability.
According to this: https://cyclonedx.org/docs/1.7/json/#vulnerabilities_items_analysis_justification
Cyclonedx vex format includes more justification able to explain the situation.
As far as I understood trivy already support Cyclonedx vex format. Not sure about grype