Use when a scanner flags a CVE that analysis shows is not exploitable in your product, and a machine-readable assertion is needed instead of deleting the finding. Writes and validates OpenVEX statements (not_affected, affected, fixed, under_investigation) with vexctl and attaches them to images.