feat(tool): Add VEX file validation tool

[JigyasuRajput]

Add VEX File Validation Tool (PR 1/2)

Overview

This PR implements a VEX (Vulnerability Exploitability Exchange) file validation tool.

Features Added

• Multi-format VEX validation: Support for CycloneDX, CSAF, and OpenVEX formats
• Schema compliance checking: Validates required fields and format-specific requirements
• CLI integration: New vex-validate command with flexible file input options
• Comprehensive error reporting: Clear, actionable error messages with field locations
• Robust error handling: Handles file errors, JSON parsing errors, and schema violations

Usage

# Validate a VEX file
cve-bin-tool vex-validate TRIAGE.json

# Using the explicit flag
cve-bin-tool vex-validate --vex-file-to-validate my-vex-file.json

[anthonyharrison]

For CycloneDX there is already a JSON schema which can be used to va;lidate the format. Rather than writing your own checks, it would be better to use the Standard schema (see here.

The same also applies for CSAF see here

Openvex schema See here

This should result in much less code!!!

[JigyasuRajput]

For CycloneDX there is already a JSON schema which can be used to va;lidate the format. Rather than writing your own checks, it would be better to use the Standard schema (see here.

The same also applies for CSAF see here

Openvex schema See here

This should result in much less code!!!

thanks for the feedback, I'll apply the changes!!

[JigyasuRajput]

this PR is not ready for a review yet ...It still needs more cleanup!
thanks!

[JigyasuRajput]

Hey!
I've almost completed the implementation of the vex validate tool, I'll come back after some time when the CI checks have completed. I've added the standard JSON schemas to the code (which made the PR big) to improve performance and so it can work offline as well.
thanks!
cc @anthonyharrison @terriko

[anthonyharrison]

The CycloneDX schemas needs to support the different versions of the CycloneDX standard. Need to incluide schema for 1.5 and 1.6 as well. Schema validation will then need to validate against each version until it either validates or you have exhausted all the schemas.