[SECURITY] publish a VEX/VDR

[jkowalleck]

This library might have/had vulnerabilities, see https://github.com/CycloneDX/cyclonedx-javascript-library/security/advisories
and #1061

We intend to have all security issues closed/fixed eventually, if not already.

We should make this transparent to the user, by publishing a Vulnerability Exploitability eXchange (VEX) documentand and a Vulnerability Disclosure Report (VDR).

Expected outcome:

• publish VEX and VDR - as separate files, at best. if neededd, use Bom-Links to cross-reference.
• files should be in format of CycloneDX 1.6
• the files should be schema-validated as part of the dogfooding-CI
• the files are dynamic (changes over time) - so no intention to ship it in distributing
• files should include a VEX and a VDR -- maybe use dedicated files {vex,vdr}.cdx.* , instead of one security.cdx.*

for the content, see distinction https://github.com/CycloneDX/bom-examples/blob/master/VDR/README.md#distinction-between-vulnerability-disclosure-report-vdr-and-vulnerability-exploitability-exchange-vex