Add proto definition for vuln predicate type

[hectorj2f]

This PR adds a proto definition for the vuln predicate type. This was pending since we added the vuln predicate type and it is needed to update the cosign vuln predicate types.

[hectorj2f]

related to #268

[TomHennen]

Thanks for sending this.

Besides the other comments, have you by any chance generated any json with this? Could you provide a sample? it would be nice to compare it against the example https://github.com/in-toto/attestation/blob/main/spec/predicates/vuln.md#example

[marcelamelara]

Friendly ping on this PR. @hectorj2f Could you please remove the generated Go/Python/Java files and add an entry for this proto here? then I think your PR will be pretty much ready to go.

[hectorj2f]

@marcelamelara Yes, I'll do it.

[TomHennen]

I think something might have gotten a bit screwy with the git commits (I've done this myself for sure). When I look at 'Files Changed' it doesn't look like anything has changed since our earlier comments?

[hectorj2f]

I'm confused now. I followed what @marcelamelara commented above remove all the generated go/python and java code and leave the entry in protos.

[marcelamelara]

If I understand correctly, having only the .proto file is what Tom had originally requested. But there may have been some edits to that proto file that were lost when the auto-generated files were removed? I only see 1 commit in this PR right now.

Separately, I also had requested a minor documentation update to the /protos/README.md file. This way this new proto is included in that list.

[TomHennen]

Thanks for these changes, just a couple minor updates needed I think.

[marcelamelara]

Thanks @hectorj2f ! LGTM.

[marcelamelara]

One final question (which can be addressed in a separate PR, I think) is about the predicate type URI for this predicate. Right now, in the vuln predicate spec it's listed as https"//in-toto.io/attestation/vuln_s_ rather than /vuln which is the name we use everywhere else. Does the spec have a typo? We usually want the name to match everywhere, but I'm also worried that tooling might already be using the pluralized type URL.

@hectorj2f What do you think? Is this a concern?

[hectorj2f]

@marcelamelara Let's change vuln to vulns wherever we use it as part of a different PR.

[hectorj2f]

@marcelamelara @lumjjb I've applied some of the changes you proposed.

[marcelamelara]

Thanks so much for the updates @hectorj2f ! At this point the changes I'm requesting are just some small documentation fixes.

[marcelamelara]

Thanks @hectorj2f ! LGTM

[TomHennen]

I appreciate these changes, but the one big problem I see is that it erases the old 'vuln v0.1' predicate and replaces it with this new one.

There are folks that are using the old predicate (however flawed it might be me), we should keep that copy around for them to reference.

So a couple requests:

1. Leave the old vuln.md there (folks probably have links to it). Maybe add a note pointing them at the newer version.
2. Update the version in the new vulns to 0.2
3. Update the proto to match 0.2. (including it's path in the Protos directory)
4. Rename vulns.md to vulns_02.md

[hectorj2f]

@TomHennen I believe I've made all your requested changes.

[TomHennen]

Thank you! And I'm so sorry it took me so long to get back to this. I missed the email about the update. :(