Exclude options

**What would you like to be added**:
Ability to exclude items from the reports -- quite possibly ported and/or moved from the Grype excludes.

**Why is this needed**:
Some projects include only a small portion of a library that may be reported as vulnerable. It is not accurate to report these as "included".

**Additional context**:
Talking with the containerd folks, there are some packages which could result in false positive vulnerability scans, or even somewhat falsely reported as included because they are only using one package out of many, it would be very useful to prescriptively exclude certain results: https://cloud-native.slack.com/archives/CGEQHPYF4/p1634051863179900?thread_ts=1633986885.169500&cid=CGEQHPYF4

The issue names reports and Grype excludes but no Syft files, tests, or entry point. Start by locating the report-generation path and comparing the requested behavior with Grype's exclusion model; done means users can prescriptively exclude selected results from reports.

Written by the indexing model from the issue text.