indicate/filter out wontfix matches from results

[wagoodman]

Either filter or annotate wont-fix matches

[alfredodeza]

@wagoodman where does the information about a wontfix show? Looking in different spots and I can't find any good places to look

[wagoodman]

I haven't looked closely yet either. Today anchore-engine is doing this kind of filtering, so that could be a place to start. A guess would be that its data from the upstream vulnerability feed data for each linux distribution, either as an explicit field (which I don't recall existing) or derived from a field (such as severity).

[zhill]

We should enable a filter, but not have it done by default. We should default to showing everything.

[luhring]

@wagoodman Checking with you before taking action — but I'm thinking we might be able to close this now, since we can use our "ignore" functionality to filter by fix state now (https://github.com/anchore/grype#specifying-matches-to-ignore)

[wagoodman]

Oh yeah, this is an oldie goldie