feat(attestation): add optional location field to PolicyVulnerabilityFinding
Closes #3446
Adds an optional location field to PolicyVulnerabilityFinding, mirroring the location field PolicySASTFinding already carries.
Vulnerability scanners report one match per location where a package is found. The same package can appear more than once in a single artifact — each copy a distinct SBOM component with its own bom-ref but an identical purl — and until now a finding had no field to express which copy it referred to. The field holds a file path where one is available, falling back to the SBOM component reference otherwise.
The field is optional and unset by every policy in the field today, so existing behaviour is unchanged. Because findings are unmarshalled with protojson DiscardUnknown, declaring it in the schema is what makes a policy-supplied value survive into the attestation instead of being dropped.
The CLI surfaces the location alongside the package when describing a workflow run.
AI assistance: this change was produced with Claude Code, as disclosed by the Assisted-by: trailer on the commit, per AI_POLICY.md.
🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri