Support for suppression

[prabhu]

A tool like dep-scan inevitably produces false positives due to aliasing and SBoM generation lifecycle.

While tools like trivy offer ignore files and rego policies to support advanced filtering, depscan could offer a toml based solution instead.

Regarding file naming and folder structure, it might be wise to adopt dot-config instead of spoiling the root folders of every repo.

https://dot-config.github.io

So suppression lists could be kept under .config/depscan/*.toml with an optional --config-dir to override this directory for integration use cases.

[cerrussell]

@prabhu Is there a purpose for the depscan folder under .config since dot-config is talking about a .config directory at the repository level?

To clarify the --config-dir option, should this be to not use a suppression list or do you mean an alternative toml path to load?