test(vex): cover misc survivors flagged by cargo-mutants

[Metbcy]

What

Follow-up to #51. Targets the remaining (non-apply.rs) survivors from the #35 cargo-mutants run on src/vex/**.

Coverage added

• VexEffect::justification() — assert the getter returns the inner Option for both Suppress and Annotate variants, and that None passes through (not coerced). Kills the 3 mutants on the getter.
• VexIndex::is_empty() — explicit empty vs populated assertions. Kills replace-with-true / replace-with-false.
• detect_format() CycloneDX arm — an SBOM with no vulnerabilities, and one with a vulnerabilities object (not array), must both NOT match CycloneDxVex. Kills the && -> || mutant at mod.rs:162 that would otherwise cause every CycloneDX SBOM to be misdetected as VEX and fail loudly during parse.
• parse_synthetic_id() version-jump arm — empty before ("->4") and empty after ("1->") must both reject. Kills the || -> && mutant at synthetic_id.rs:125 that would accept half-empty version pairs.

Test counts

• Before: 391 lib tests (or 399 if test(vex): cover apply() counter and effect branches #51 lands first)
• After: 394 lib tests added in this PR (+3 new test fns; existing parse_synthetic_id_rejects_malformed_strings extended with 2 cases)

All green locally: RUSTFLAGS="-D warnings" cargo build --all-targets --all-features + cargo clippy --all-targets --all-features -- -D warnings + cargo fmt --check.

Refs #35. Stacks cleanly with #51 (no overlap).

[github-actions]

Coverage report

Line coverage: 84.3% (9445 / 11206 lines)

Full lcov report available as workflow artifact coverage-lcov: download from this run.

_{v0.9.8 introduces this report; --fail-under-lines will be added once coverage is visible across 2–3 releases.}