fix(vuln) unique vulnerabilities from different data sources

[rahul2393]

Issue
Last reported case aquasecurity/trivy-action#22 (comment)

[codecov]

Codecov Report

Merging #984 (a774192) into main (a00d719) will decrease coverage by 6.32%.
The diff coverage is 52.25%.

@@            Coverage Diff             @@
##             main     #984      +/-   ##
==========================================
- Coverage   68.50%   62.18%   -6.33%     
==========================================
  Files          57       65       +8     
  Lines        2210     2626     +416     
==========================================
+ Hits         1514     1633     +119     
- Misses        564      858     +294     
- Partials      132      135       +3     

Impacted Files	Coverage Δ
pkg/commands/artifact/config.go	81.81% <ø> (ø)
pkg/commands/artifact/fs.go	0.00% <0.00%> (ø)
pkg/commands/artifact/image.go	0.00% <0.00%> (ø)
pkg/commands/artifact/repository.go	0.00% <0.00%> (ø)
pkg/commands/artifact/run.go	0.00% <0.00%> (ø)
pkg/commands/artifact/wire_gen.go	0.00% <0.00%> (ø)
pkg/commands/client/config.go	79.31% <ø> (ø)
pkg/commands/client/run.go	0.00% <0.00%> (ø)
pkg/commands/client/wire_gen.go	0.00% <0.00%> (ø)
pkg/commands/config/cache.go	100.00% <ø> (ø)
... and 43 more

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 415e1d8...a774192. Read the comment docs.

[simar7]

@knqyf263 would you know if the detected vulnerabilities can include duplicates? This PR handles the case but I'm curious why it happens in the first place to begin with. For example see this test https://github.com/aquasecurity/trivy/pull/984/files#diff-b831e004a3a89308d4c295025cf963c7e4f9c29d8d6f9377fea03ceb3a5cc655R352-R371

[knqyf263]

It is possible to happen since Trivy DB might have multiple data sources for the same target. For example, Trivy DB has GItLab Advisory Database and GitHub Security Advisories for Java detection. Then, they might have the same vulnerabilities.