Add ability to see that Trivy doesn't support detecting vulnerabilities in the found OS for json format

[DmitriyLewen]

Description

Trivy shows information about unsupported OS only in log message (e.g. 2024-05-04T08:27:07Z WARN Unsupported os family="fedora").
But if log is supressed (--quiet flag) - users don't have option to understand that Trivy doesn't support detecting vulnerabilities in the found OS.

As solution we can add new bool field (e.g. vulnScanningSupported) into OS struct.
Or we can use string field (supported, unsupported and disabled) to avoid confusing users when vuln vulnerability scanning is disabled.

Target

Container Image

Scanner

Vulnerability

[knqyf263]

We need a "supported" flag both for SBOM and vulnerabilities.

[Bah-bah]

Any chance it will be available in the next release?

[badgerinspace]

This would be extremely helpful for companies that triage vulnerabilities based on the JSON files alone. As is, there's no indication in that workflow that no vulnerabilities were detected because the OS isn't supported.