[FEATURE] add `json` format to cves command

Currently, there is no machine-readable output format for the cves command that supports listing both the architecture of the image and the fixed_in version of the vulnerability.

While this information is available separately in different formats—for example, architecture is included in the sbom format and fixed_in is available in the sarif format—there is no single format that provides both.

I propose adding a new json output format that includes both fields. This is not a new requirement; tools like Grype and Trivy already support formats that include this information. Even Docker Scout has a packages format that provides these details, although it is in a pretty-printed format and not machine-readable.

Implementing this should not be difficult, as the information is already available internally.

The following are the basic requirements that are expected in a single format:

• vuln_package
  • name
  • installedVersion
  • fixedVersion
  • vulnerabilityID
• image:
  • os_type
  • os_version
  • os_arch

Start with the cves command and inspect the existing sbom and sarif output formats to find where vulnerability and image data are assembled. Add a machine-readable json format containing the requested package fields and image OS, version, and architecture, then verify its output against the stated requirements.