chore: show VEX notice for OSS maintainers in CI environments

[knqyf263]

Overview

This PR introduces a VEX (Vulnerability Exploitability eXchange) notice for OSS maintainers when Trivy is run in CI environments. The notice aims to encourage the use of VEX statements for more accurate vulnerability reporting.

Key Changes

1. Implement a VEX notice that displays after vulnerability scanning results.
2. Add logic to show the notice only in CI environments.
3. Provide an option to disable the notice via an environment variable (TRIVY_DISABLE_VEX_NOTICE).

Example Output

$ CI=true ./trivy image alpine:3.20
...

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/dev/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


alpine:3.20 (alpine 3.20.2)
===========================
Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

Rationale

• Encourages OSS maintainers to use VEX for more accurate vulnerability reporting.
• Targets CI environments to avoid disrupting local development workflows.
• Provides an easy opt-out mechanism for users who don't need the reminder.

Related PRs

• feat(vex): VEX Repository support #7206

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[DmitriyLewen]

@knqyf263 LGTM, can you update tests?

[knqyf263]

It worked locally, but failed due to CI=true on GitHub Actions 😄