add command to surface vulnerability scan report for a bundle

**Describe the problem/challenge you have**

would like to see a vulnerability report for images that are part of a bundle.

**Describe the solution you'd like**

even though vulnerability scanning is an "addon" to a registry (not part of official registry APIs), i think we should try to integrate with projects like Harbor that introduce custom APIs to expose such information. i could imagine something like this:

```
$ imgpkg vulnreport -b registry.corp.com/apps/my-bundle

Id State Details Full reference
foo OK 0 vulnerabilities foo@sha256:...
blah FAIL 100 vulnerabilities foo@sha256:...
```

inspiration: https://github.com/vmware-tanzu/carvel-kbld/issues/79