fix: Prevent grouped vulnerability entries by including target and package path

[kersten]

Description

This PR addresses an issue in the collectVulnerabilityIdReports method where only one metric was being reported for multiple binaries with the same Vulnerability ID within the same image. The root cause was that the method only considered the VulnerabilityID when determining uniqueness, causing subsequent findings with the same ID to be ignored.

Changes Made:

• Updated the key used for tracking vulnerabilities in the collectVulnerabilityIdReports method to include additional attributes (Target and PkgPath), ensuring each vulnerability is uniquely identified based on its ID, target, and package path.
• Modified the vulnList map to use the concatenated string of VulnerabilityID, Target, and PkgPath as the key.
• Ensured that all occurrences of vulnerabilities in different binaries or paths are correctly reported in the metrics.

This change improves the accuracy of the vulnerability metrics reported, especially for images containing multiple binaries and applications with numerous dependencies, such as Java applications, where a CVE could be present in multiple libraries.

Related issues

• Close Metrics Report Only One Finding for Multiple Binaries with Same Vulnerability ID #2139

Checklist

• I've read the guidelines for contributing to this repository.
• I've added tests that prove my fix is effective or that my feature works.

[chen-keinan]

@kersten lgtm 🚀 thanks for the contribution