[ECR] [request]: Support whitelisting certain CVE findings

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
We would like to be able to whitelist some vulnerabilities when doing an ECR scanning

**Which service(s) is this request for?**
ECR

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
We have a Docker image in an ECR repository. Scanning the image reports one vulnerability about a library we're using. According to the library documentation, the vulnerability is fixed in the version of the library we're using and it could be a false positive.
We're thinking about several actions to follow. One of them is whitelisting this specific vulnerability, but it's not possible with AWS ECR scanning.

**Are you currently working around this issue?**
We're using another Linux base image, but the new generated image is bigger than the original one, about 3 times bigger.

Start by reviewing the ECR image-scanning workflow described in the issue and how it reports CVE findings for Docker images. No repository files or tests are named; done would mean defining and documenting a way to whitelist selected vulnerabilities while retaining scanning for the remaining findings.

Written by the indexing model from the issue text.