Consider ignoring CVEs that are marked as "wont-fix"

[apyrgio]

When we scan the soon-to-be-merged Dangerzone Debian image (see #1046), we see several CVEs that are marked as wont-fix. These CVEs have varying severities, and some are even Critical. Usually, when the Debian Security team marks a CVE as wont-fix, it means that they have assessed its impact and deemed that it's not important for various reasons, mainly build options. Still, Grype can't know this, and will error out if we ask it to fail for CVEs with Critical severity.

For the time being, we have decided to let the tool fail, so that we can check the Debian's Security team advisory, and ignore the CVE in .grype.yaml, if we feel the explanation makes sense. In the future, it may make sense to run Grype with the --ignore-states wont-fix option. Note that this option is not present in anchore/scan-action (see Action Inputs), so we may have to run this tool differently, e.g., with:

podman run --rm -v /tmp/container.tar:/container.tar anchore/grype:latest /container.tar --ignore-states wont-fix