[REQ] Add optional support for VEX statements in the CSAF format.

[JasonRShaver]

What kind of request is this?

Improvement of existing experience

What is your request or suggestion?

While copa supports the OpenVEX format promoted by OpenSSF, it'd be useful to also support the CSAF format to enable easy integration with CSAF security and vulnerability management tooling.

If this would require a PR, I expect I can pull something together (next time I'm in a hack-a-thon or find an aligned stakeholder).

Are you willing to submit PRs to contribute to this feature request?

• Yes, I am willing to implement it.