Add Dependency-Track VEX reporting

[TaniaGithub0401]

This PR extends the reusable SBOM vulnerability workflow with Dependency-Track integration.

Instead of generating OpenVEX directly from the Grype results, the workflow now uses the findings identified by Dependency-Track to generate a CycloneDX VEX document. This allows the VEX analysis to be matched directly to the components and vulnerabilities known by Dependency-Track.

The workflow now:

• uploads CycloneDX SBOMs to Dependency-Track and automatically creates the project if needed
• waits for the SBOM analysis and retrieves the project findings
• generates CycloneDX VEX for new findings and sets them to in_triage
• keeps existing analysis states and suppressed findings unchanged
• supports both Docker and Python SBOMs
• keeps the Dependency-Track logic in a reusable composite action

The existing Grype/SARIF scan and GitHub Security reporting remain unchanged.

[mmacata]

Thank you a lot for this improvement!! (: