Add Support for Alternative VDR Generation Using Dependency Track’s CVE Data

[mnkhodad]

Use Dependency Track to fetch CVEs for OpenJDK based on its SBOM and generate an alternative VDR and VEX report. This requires getting a CPE or pURL in the Temurin SBOM so Dependency Track has something to index from.

Part of: #163