Fix bug regarding cyclonedx format with contextFlags and --vuln flag

[eranturgeman]

• The pull request is targeting the dev branch.
• The code has been validated to compile successfully by running go vet ./....
• The code has been formatted properly using go fmt ./....
• All static analysis checks passed.
• All tests have passed. If this feature is not already covered by the tests, new tests have been added.
• Updated the Contributing page / ReadMe page / CI Workflow files if needed.
• All changes are detailed at the description. if not already covered at JFrog Documentation, new documentation have been added.

---

This PR fixes the following issue:
Cyclonedx output does not support currently in violations. When providing a context flag (--project/ --repoPath/ --watches) we always assume violations context.
When we add --vuln flag we expect for vulnerabilities as well, and those can be parsed into the CDX. Also - not every time we use a project we actually want to be in violations mode.
I added an overpass for the scenario when a cycloneDx is requested with a context flag and --vuln. In this scenario only vulnerabilities will be parsed, excluding violations.
I added an indicative log explaining that as well as an addition to the --format flag.

[attiasas]

LGTM, check out my comment

[github-actions]

---

🐸 JFrog Frogbot