[feature] Unionize parsing for cdx SBOM and VEX data

[stevemenezes]

Description of the PR

Followup to #1181

• Unionize parser for SBOM and VEX BOM
• Yet to add tests

PR Checklist

• All commits have a Developer Certificate of Origin (DCO) -- they are generated using -s flag to git commit.
• All new changes are covered by tests
• If GraphQL schema is changed, make generate has been run
• If collectsub protobuf has been changed, make proto has been run
• All CI checks are passing (tests and formatting)
• All dependent PRs have already been merged

[jeffmendoza]

In general, it might make sense to move the parsing up to the Parse() function, and bubble up all errors there, then save the calculated ingestPredicates as a part of the struct, then GetPredicates() can just return them.

It'll be nice to see the example json input and expected ingestPredicates outputs in the tests.

[jeffmendoza]

For the "unknown time" where we want to put "zero time", use time.Unix(0, 0) and not time.Time{}, the latter is considered empty by graphql and doesn't work in any schema where the time value is a required field.

[pxp928]

LGTM! Thanks @stevemenezes

[jeffmendoza]

LGTM!

[pxp928]

@stevemenezes just need to fix the CI errors and should be ready to merge