fix(vex): avoid panic on CSAF advisory without a CVE

[dervoeti]

Description

Scanning with a CSAF VEX document crashes with a nil pointer panic when the document contains a vulnerability that has no cve property.

The cve property is optional in a CSAF vulnerabilities entry: an advisory may instead be identified only by its ids (for example a GitHub Security Advisory / GHSA identifier). CSAF.NotAffected dereferenced *item.CVE unconditionally while searching for the matching advisory, so any such entry triggered a segfault:

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x8 pc=0x706299f]

goroutine 1 [running]:
github.com/aquasecurity/trivy/pkg/vex.(*CSAF).NotAffected.func1(...)
    github.com/aquasecurity/trivy/pkg/vex/csaf.go:38
github.com/samber/lo.Find[...](...)
    github.com/samber/lo@v1.53.0/find.go:74
github.com/aquasecurity/trivy/pkg/vex.(*CSAF).NotAffected(...)
    github.com/aquasecurity/trivy/pkg/vex/csaf.go:37
...

This change matches a vulnerability by its CVE when one is present and falls back to the ids entries otherwise. This both fixes the panic and lets GHSA-only advisories be matched by their identifier.

There is no associated issue, the fix is small and self-contained, so per the contributing guide I'm including the justification here instead.

Before

$ trivy image <image> --vex advisory.json
...
2026-... INFO  [rustbinary] Detecting vulnerabilities...
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation ...]
    github.com/aquasecurity/trivy/pkg/vex/csaf.go:38
...

(where advisory.json is a CSAF document containing at least one vulnerabilities entry that uses ids instead of cve, e.g.)

"vulnerabilities": [
  {
    "ids": [
      { "system_name": "GitHub Security Advisory", "text": "GHSA-2r2c-cx56-8933" }
    ],
    "product_status": { "known_not_affected": ["..."] },
    "threats": [{ "category": "impact", "details": "vulnerable_code_not_in_execute_path" }]
  }
]

After

The scan completes normally, and a GHSA-only known_not_affected / fixed statement now filters the matching detected vulnerability just like a CVE-based one.

Related issues

N/A

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (not needed).
• I've added usage information (no new options).
• I've included a "before" and "after" example to the description (included above).

[CLAassistant]

All committers have signed the CLA.