feat(vuln): add `--relationship` flag to filter vulnerabilities by package relationship about trivy

[knqyf263]

We definitely need to add information about what relationships are available for files.
e.g. only go and Rust binaries, pom and gomod files support root relationships.

Yes, we should document it. In most cases, -f json helps to understand relationship types.

[knqyf263]

@DmitriyLewen Any comments?

[DmitriyLewen]

--relationship root,direct

We definitely need to add information about what relationships are available for files.
e.g. only go and Rust binaries, pom and gomod files support root relationships.

it may be necessary to either disable the --relationship flag or remove the dependencies section from the SBOM output.

I think we need to start from disabling relationship flag for all sbom formats (cyclonedx, spdx, github).
For templates we can leave this flag (it will be same logic as for table format).

Otherwise looks like a very good idea 👍