Hello!

I was recently using grype with VEX to filter false positives on my vulnerabilty scans.
As far as I understood VEX documents are currently supported only when using SBOMs in syft-json format.

syft alpine@sha256:124c7d2707904eea7431fffe91522a01e5a861a624ee31d03372cc1d138a3126 --output syft-json=grype-alpine.sbom.syft
grype sbom:grype-alpine.sbom.syft --vex ./grype/grype/vex/testdata/vex-docs/openvex-demo2.json --show-suppressed

I would need to use the cyclonedx-json format, but this doesn't seems to work now:

syft alpine@sha256:124c7d2707904eea7431fffe91522a01e5a861a624ee31d03372cc1d138a3126 --output cyclonedx-json=grype-alpine.sbom.cdx
grype sbom:grype-alpine.sbom.cdx --vex ./grype/grype/vex/testdata/vex-docs/openvex-demo2.json --show-suppressed

This PR adds support for setting a default product values in case the productIdentifiersFromContext doesn't return anything. This happens when the input SBOM is not in syft-json format. I suppose this is because the pkg.Provide function is not able to retrieve the expected product name, when returning the pkgContext, with other formats.
If this fix works for you I can add tests or documentation accordingly. Just let me know.

Fixes #2471

Thanks for this nice project :)