docs(vex): how the Asset page builds VEX statements when findings disagree

[blakeaowens]

Description

Documents how DefectDojo Pro's Asset page builds VEX statements, and corrects a claim that the Asset page and API exports are interchangeable.

• Exporting SBOMs and VEX (asset_modelling/locations/PRO__exporting_sboms_and_vex.md): the Asset page and the /api/v2/ endpoints emit the same specification version, but their VEX statements come from different data. The API reads each Finding's per-dependency status; the Asset page reads each Finding's own VEX analysis.
• A new How the Asset page builds VEX statements subsection:
  • the state a Finding gets when it has no VEX analysis;
  • the least-resolved rule when the Findings for one vulnerability disagree: per component, the asset-wide case for Findings with no component, and separate entries per state;
  • so two hosts with different states for one vulnerability in the same component never export as one not_affected.

English pages only: the translated copies are regenerated by the docs translation pipeline.

Test results

Documentation only. The one new link is an in-page anchor to an existing heading.

Checklist

• Documentation only.

🤖 Generated with Claude Code