Validate CPEs somehow

[lazka]

sqlite3 -noheader "$(grype db status -o json | jq -r '.path')" \
  "SELECT json_group_array(json_object(
     'vendor', vendor,
     'product', product))
   FROM (
     SELECT DISTINCT
       vendor,
       product
     FROM cpes
     WHERE part = 'a'
     ORDER BY vendor, product
   );" | jq \
  > cpe_min.json

This gives all CPEs grype knows about. It might make sense to store this somewhere so we can lint the CPEs we use. I don't know how good the grype coverage is though.