fix: address review feedback on VEX status code error

- Replace the misleading "did not receive 2xx status code" message with
  "unexpected status code %d from %s" using vexUrl.Redacted(), per
  maintainer suggestion. Avoids the 200-vs-2xx wording confusion and
  redacts any credentials in the URL.
- Simplify the test to a single string-typed wantErr field (matching the
  pkg/x/json test style) instead of separate wantErr/wantErrMsg fields,
  and assert the error message for the incompatible-VEX case too.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: eran132

pkg/vex/sbomref.go

@@ -84,7 +84,7 @@ func retrieveExternalVEXDocument(ctx context.Context, vexUrl *url.URL, report *t
 	defer res.Body.Close()
 
 	if res.StatusCode != http.StatusOK {
-		return nil, xerrors.Errorf("did not receive 2xx status code: %d", res.StatusCode)
+		return nil, xerrors.Errorf("unexpected status code %d from %s", res.StatusCode, vexUrl.Redacted())
 	}
 
 	val, err := io.ReadAll(res.Body)

pkg/vex/sbomref_test.go

@@ -79,45 +79,38 @@ func TestRetrieveExternalVEXDocuments(t *testing.T) {
 	t.Cleanup(s.Close)
 
 	tests := []struct {
-		name       string
-		input      *types.Report
-		wantVEXes  int
-		wantErr    bool
-		wantErrMsg string
+		name      string
+		input     *types.Report
+		wantVEXes int
+		wantErr   string
 	}{
 		{
 			name:      "external vex retrieval",
 			input:     setupTestReport(s, vexExternalRef),
 			wantVEXes: 1,
-			wantErr:   false,
 		},
 		{
 			name:    "incompatible external vex",
 			input:   setupTestReport(s, vexUnknown),
-			wantErr: true,
+			wantErr: "unable to load VEX from external reference",
 		},
 		{
-			name:       "vex not found",
-			input:      setupTestReport(s, vexNotFound),
-			wantErr:    true,
-			wantErrMsg: "did not receive 2xx status code: 404",
+			name:    "vex not found",
+			input:   setupTestReport(s, vexNotFound),
+			wantErr: "unexpected status code 404",
 		},
 		{
 			name:      "no external reference",
 			input:     setupEmptyTestReport(),
 			wantVEXes: 0,
-			wantErr:   false,
 		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			got, err := vex.NewSBOMReferenceSet(tt.input)
-			if tt.wantErr {
-				require.Error(t, err)
-				if tt.wantErrMsg != "" {
-					require.ErrorContains(t, err, tt.wantErrMsg)
-				}
+			if tt.wantErr != "" {
+				require.ErrorContains(t, err, tt.wantErr)
 				return
 			}
 			require.NoError(t, err)