fix: scope package VEX suppression to package

[huynhtrungcip]

Summary

• apply ComponentNotPresent package VEX signals to the annotated package instead of the entire source
• remove source-wide rendered-output suppression for PackageSource ExperimentalPES
• add a regression test for sibling packages sharing one source

Tests

• go test ./pkg/osvscanner ./internal/output