Ingest upstream vex sources

[Dboy0ZDev]

Related to Issue: #1977

[Copilot]

Pull request overview

This PR adds initial support for ingesting upstream OpenVEX sources by (1) fetching OpenVEX JSON documents from a GitHub repository and (2) transforming OpenVEX statements into DevGuard VEX rules, alongside a small adjustment to CycloneDX VEX rule path-pattern creation.

Changes:

• Add OpenVEX-to-VEXRule transformation logic and event-type mapping in VEXRuleService.
• Add GitHub repository crawling + raw-file download to collect OpenVEX JSON documents in scanService.
• Introduce a normalized VexReportOpenVEX wrapper with validation helpers.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
services/vex_rule_service.go	Adds OpenVEX parsing + status mapping; adjusts CycloneDX-derived path-pattern building
services/vex_rule_service_test.go	Adds unit tests for OpenVEX parsing behavior
services/scan_service.go	Adds GitHub repo traversal and raw download helper to fetch OpenVEX JSON files
services/scan_service_test.go	Adds tests for GitHub OpenVEX fetching via a mocked GitHub API
normalize/sbom_graph.go	Introduces VexReportOpenVEX and basic OpenVEX report validation

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.