OpenVEX from reachability — which advisories cannot be triggered

Subtract the advisories no attacker-controlled data can reach.

An SBOM scan on a real project returns hundreds of findings, and a queue nobody can triage is a queue everybody ends up ignoring. This turns the reachability analysis into the standard vocabulary for saying which ones do not apply, so downstream tooling can subtract them too.

What it will not do is guess. See vdb/harden/vex.py for the justification mapping and, more importantly, for what is deliberately absent from it.