internal/openvex: omit vulns with no findings

This change modifies govulncheck's VEX output to no longer include
vulnerabilities that are not imported at a vulnerable version.
This matches the text output of govulncheck, and is in line with most
other vulnerability scanners.

updates golang/go#68338

Change-Id: If7041fd4624d023f623db8daf35a2e76f41d1d29
Reviewed-on: https://go-review.googlesource.com/c/vuln/+/597396
LUCI-TryBot-Result: Go LUCI <[email protected]>
Reviewed-by: Mauri de Souza Meneguzzo <[email protected]>
Reviewed-by: Zvonimir Pavlinovic <[email protected]>