fix: Detect app vulnerabilities in container scans

[pjrharley]

I have found that my container scan correctly prints out that there is a critical vulnerability, but then the build happily passes:

Tested 4 projects, 1 contained vulnerable paths.
...
no vulnerabilities of at least 'critical' severity were detected, not failing build

Running the scan locally I could see the output doesn't put the vulnerabilities at the top level of the JSON output
and so they are totally ignored. This change means that we look through all the application vulnerabilities also if they exist.

[CLAassistant]

All committers have signed the CLA.