v0.34.0 — pass an OpenVEX document to the image scanner New scan_vex_file input on docker-image-workflow.yml takes a path in the repo to an OpenVEX document, passed to Grype as --vex, for a CVE the maintainer has assessed as not affecting the image. Unlike an ignore list it records why: a machine-readable justification plus a human impact statement, in a reviewable file. New scan_only_fixed reports only vulnerabilities with a published fix. Both were already supported by the pinned scan-action and simply never wired. Defaults preserve the previous behaviour exactly. A VEX-suppressed finding also leaves the Security tab, so a wrong assertion hides a real vulnerability -- documented at the input and in the README. The scan jobs check the repo out only when a VEX path is set, since otherwise it resolved to nothing on a runner that had never cloned the repo.