Add match details to CycloneDX vulnerabilities

[msnandhis]

Summary

Include Grype match details in CycloneDX vulnerability entries as a custom property.

Each vulnerability with match details now has a grype:match:details property whose value is the complete matchDetails array encoded as JSON. Vulnerabilities without match details do not receive the property.

Motivation

CycloneDX output currently omits the evidence that explains how Grype matched a vulnerability. Consumers need that information to distinguish direct and indirect matches and make better-informed triage decisions.

Approach

• Serialize the existing models.MatchDetails collection without changing its shape.
• Use one grype:match:details property so the complete ordered collection survives both CycloneDX JSON and XML output.
• Propagate serialization errors instead of silently dropping match evidence.
• Update CycloneDX presenter snapshots.

The issue confirms that CycloneDX properties are the intended extension point, but it does not prescribe the exact property name or whether the data should be flattened. This draft uses a single JSON-valued property to preserve nested match evidence losslessly. Maintainer feedback on that representation is welcome before this is marked ready.

Testing

• go test ./grype/presenter/cyclonedx -count=1
• make static-analysis
• git diff --check

Tests cover direct and indirect match details, omission for empty details, JSON and XML round trips, and serialization errors.

Closes #3513

AI assistance

AI-assisted tools were used during implementation and test development. I reviewed the resulting diff, verified the behavior locally, and take responsibility for the contribution.