The `ignore-base`, `ignore-unchanged`, `only-fixed`, `only-severities` parameters should add-up together

Issue

I've been implementing this action to ensure our engineering team is informed if new vulnerabilities are introduced into our Docker image through the development process, particularly in PRs.

We want to avoid overwhelming the team with action comments in the PRs, as this could lead to warning fatigue. If notifications aren't actionable, they will likely be ignored over time.

Expected behavior

To address this, I would expect the ignore-unchanged option to prevent cves, recommendations, or compare information from being displayed when no new vulnerabilities have been introduced compared to the base image.

Additionally, the following options should work together: ignore-base, ignore-unchanged, only-fixed, only-severities.

Here’s what I envision:

with:
  command: quickview,cves,recommendations,compare
  image: <built-image>
  to: <base-image>
  ignore-base: true
  ignore-unchanged: true
  only-fixed: true
  only-severities: critical,high

This configuration would only display information in a PR if: there are new fixable high or critical vulnerabilities in the built image. Otherwise no information is displayed in the PR.

Current behavior

Even with all these parameters, comments will be displayed under the above condition.

The issue does not mention specific files or tests. Start by tracing how the ignore-base, ignore-unchanged, only-fixed, and only-severities parameters are handled for the quickview, cves, recommendations, and compare commands. Done means a pull request comment appears only when new fixable high- or critical-severity vulnerabilities are present.