Suppress vulnurability for specific dependency

**Is your feature request related to a problem? Please describe.**

* I have developed three projects that I scan, lets call them App1, App2 and the internal library IntLib.
* Both App1 and App2 has a dependency on IntLib.
* IntLib in its turn has a dependency on the external library ExtLib.
* The OWASP check reports a vulnerability in ExtLib, let's call it CVE-777.
* As a result, the scan of both App1 and App2 also report CVE-777.
* I have a global suppression file where I like to add a rule that suppresses CVE-777.
* But! The suppression rule should ONLY apply when the report results from a dependency on IntLib.
* If App1 or App2 adds a _direct_ dependency on ExtLib then the rule should NOT apply.

I'd like a way to create a rule in an OWASP Check [suppression file](https://jeremylong.github.io/DependencyCheck/general/suppression.html) that works in this way. Optimally I would like to add this suppression to a global suppression file.

I have posted a [Stack Overflow question](https://stackoverflow.com/questions/76127249/suppress-vulnurability-detection-for-single-dependency) about this, but since I don't think there is a solution currently I write here also.

**Describe the solution you'd like**
A way to specify that an suppression rule should only apply when a vulnerability results from a specified dependency.

Example, which uses the suggested element `whenDependencyOf` to specify that the rule should only apply when CVE-777 is reported for a (transitive) dependency of IntLib.

```

mygroup:int-lib
^pkg:maven/ext-lib@.*$
CVE-777

```

**Describe alternatives you've considered**
I can see three alternative solutions:

1. Include the suppression rule for CVE-777 in the suppression files of ALL projects that use IntLib. This involves a significant duplication of suppression rules.
2. Include the suppression rule for CVE-777 in a global suppression file.
3. Include the suppression file for IntLib when running OWASP check for both App1 and App2.

All the solutions have the following problem: CVE-777 is suppressed not only for IntLib's use of ExtLib. Instead CVE-777 is suppressed for ALL uses of ExtLib. If App1 or App2 add a direct dependency on ExtLib, or on another dependency which in turn uses ExtLib, they might trigger the vulnerability without being warned about it by OWASP Check.

The problem is complicated by the fact that in reality there are dozens of users of IntLib in our system.

**Additional context**

This seems to be a general problem, which causes many suppressions to be too broad. The end result may be that detected vulnerabilities are missed in cases where they may result in actual problems.

The decision to consider a vulnerability to be a false positive and suppress is often based on the use of the vulnerable dependency in a specific place in the code. Because of this I think that most often a suppression rule should be set to only apply for a specific use of the dependency. One way to do this is to add the suggested parameter `whenDependencyOf` to the suppression mechanism.