Add a vulnerability-id only mode

**What would you like to be added**:
It would be ideal to have a label and relative comparison mode that worked just as it does today with the exception of ignoring any package information associated with the matches from raw reports or labels.

This should be able to work with all existing label data.

**Why is this needed**:
This would allow us to compare the set of vulnerability IDs between runs without necessarily requiring accurate package attribution, which is the hardest part to normalize and get right most of the time.

Start by tracing the existing label and relative comparison modes, then inspect how package information is taken from raw reports and labels. Done means comparisons can use vulnerability IDs alone, ignore package attribution, and continue to work with all existing label data.

Written by the indexing model from the issue text.