Fix grype output to show CVE version number and fix

[coilysiren]

Summary

Followup to #2542

I was able to get this working locally with: grype -o template -t ./csv.tmpl --fail-on medium analytics-grants-analytics --only-fixed using the following template:

"Package","Version Installed","Vulnerability ID","Severity","Locations"
{{- range .Matches}}
"{{.Artifact.Name}}","{{.Artifact.Version}}","{{.Vulnerability.ID}}","{{.Vulnerability.Severity}}","{{ (index .Artifact.Locations 0).RealPath }}"
{{- end}}

which outputs:

"Package","Version Installed","Vulnerability ID","Severity","Locations"
"stdlib","go1.22.6","CVE-2024-34158","High","/usr/bin/gh"
"stdlib","go1.22.6","CVE-2024-34156","High","/usr/bin/gh"
"stdlib","go1.22.6","CVE-2024-34155","Unknown","/usr/bin/gh"

However, the github scan doesn't support the template output: anchore/scan-action#397

We could either:

1. wait and try and contribute a fix up-steam to the linked issue
2. run grype in GA without the anchore scan
3. parse the results.json file differently. The challenge is that the artifact with the path is adjacent to the vulernabilty with the ID and fix:
   
4. could just run the same scan twice with both outputs

Acceptance criteria

• CVE and path available in GA

[coilysiren]

could just run the same scan twice with both outputs

@acouch this is exactly what I was thinking about earlier

[acouch]

Closing as the above comment was implemented.