Option to fail the build when an ignored CVE is no longer found

[yob]

We're using the new-ish support for ignoring CVEs that we're triaged as not relevant. It's great!

The lists of ignored CVEs are growing though, and we've noticed a few of them are no longer found in the images. Mostly due to fixes being released by the relevant linux distribution.

We'd love an option to fail the build if an ignored CVE is no longer found, to encourage us to tidy up the list incrementally. Would you be open to a PR that implements it?

[jamestelfer]

Great question!

One note with this idea is that the ignore functionality supports a central ignore list found on the agent: in order to fail or otherwise notify on an out-of-date or unmatched vulnerability, we'd need to track the source of the ignore definition as well.

There are two parts to this change IMO:

• alter the annotation/output to show the set of ignore entries that were not matched in the check
• optionally fail the build if these are present (fail-on-unmatched-ignores?)

WDYT?