[Feat]: add a query showing vulnerabilities in an image that are NOT in a base image

[mikemccracken]

Is your feature request related to a problem? Please describe.

if a user pushes an image built with some base image they do not control, they may want to know if any cves found were added by the build steps they do control, so they know whether to ask for a fix from the base image owner or if they need to update something on their own.

thus it would be good a way to query cves that are in the current image but not also in another image, ideally this is configurable but by default could just be the most immediate base image, that is the image that contains the largest common subset of layers with the current image.

Describe the solution you'd like

No response

Describe alternatives you've considered

No response

Additional context

No response

[andaaron]

Backend in progress at #2185

[andaaron]

Backend and ZLI done in #2242