Ignoring Java test dependencies

**What would you like to be added**:

Some way to ignore Java test dependencies like this vulnerable-legacy log4j:

```xml

log4j
log4j
1.2.17
test

```

**Why is this needed**:

Test libs are not packaged in final JAR/WAR file. Scope "provided" is not package too.

**Additional context**:

Grype reporting log4j test libs:

```
log4j 1.2.17 java-archive CVE-2022-23307 High
log4j 1.2.17 java-archive GHSA-2qrg-x229-3v8q Critical
log4j 1.2.17 java-archive CVE-2022-23305 Critical
log4j 1.2.17 java-archive GHSA-w9p3-5cr8-m3jj High
log4j 1.2.17 java-archive CVE-2020-9493 Critical
log4j 1.2.17 java-archive CVE-2022-23302 High
log4j 1.2.17 java-archive CVE-2019-17571 Critical
log4j 1.2.17 java-archive GHSA-65fg-84f6-3jq3 Critical
log4j 1.2.17 java-archive GHSA-fp5r-v3w9-4333 High
```

Start by reviewing how Grype discovers Java archive dependencies and represents dependency scope, using the Maven XML example and the reported Grype output as the expected context. Define and test behavior that excludes test-scoped dependencies from vulnerability results without excluding dependencies packaged in the final artifact.

Written by the indexing model from the issue text.