Allow whitelisting of CVEs with .cveignore

This change allows users to ignore CVEs not relevant to their project, for example when the vulnerability does not affect their OS.

The ignore file is a text file passed in as an optional second parameter, with one CVE on each line. Comments are allowed.

Example:

.cveignore

# This is why we whitelisted this
CVE-2019-15548
# This is why we whitelisted that
CVE-2019-10192

Part of gitlab-org/distribution/team-tasks#129 (closed).