build-scan command does not log vulnerabilities

[mcanzerini]

Describe the bug

When I run the build-scan command with jfrog cli 2.64.0 on a build that contains Policy Violations, the command fails as expected but the vulnerabilities are missing in the table logs. The JSON logs work fine.

Current behavior

This is the current output I get from the build-scan command:

10:33:50 [Info] Scan of build my-app-1.0.0-snapshot is in progress
10:33:50 [Info] Waiting for Build Scan to complete...
10:34:15 [Info] The scan data is available at: https://my.artifactory.com/ui/scans-list/builds-scans/my-app-1.0.0-snapshot/scan-descendants/3236830?version=3236830&package_id=build%3A%2F%2Fmy-app-1.0.0-snapshot&build_repository=artifactory-build-info&component_id=build%3A%2F%2Fmy-app-1.0.0-snapshot%3A3236830&page_type=security-vulnerabilities&exposure_status=to_fix
10:34:15 [Info] Trace ID for JFrog Platform logs: f92eddb8471b8f44
10:34:15 [Error] One or more of the detected violations are configured to fail the build that including them
Security Violations
+-----------------------------------+
| No security violations were found |
+-----------------------------------+
License Compliance Violations
+---------------------------------------------+
| No license compliance violations were found |
+---------------------------------------------+
Operational Risk Violations
+-------------------------------------------+
| No operational risk violations were found |
+-------------------------------------------+

Reproduction steps

With jfrog-cli 2.64.0, publish a build with a policy violation, then scan the build and log the table result.

Expected behavior

10:34:15 [Error] One or more of the detected violations are configured to fail the build that including them
Security Violations
+-----------------------------------+
| **The actual violation** |
+-----------------------------------+

JFrog CLI version

2.64.0

Operating system type and version

In a docker image dotnet/sdk:8.0

[dNhax]

We are also affected by this, v2.67.0 seems to be the first affected version; this was also mentioned in the (possibly causing) PR: #163 (comment)