fix: #3762 itext licensing packages do not belong to 'cpe:/a:itextpdf:itext' CPE

[nhumblot]

Fixes Issue

Fix #3762

Description of Change

This change declares com.itextpdf.licensing/licensing-base and com.itextpdf.licensing/licensing-remote as not linked to cpe:2.3:a:itextpdf:itext:*:*:*:*:*:*:*:*

Have test cases been added to cover the new functionality?

no

[aikebah]

@nhumblot WDYT, should we also bring these suppressions into the hosted suppressions file, so that a new release is not required to make them active?

[nhumblot]

Hi @aikebah 👋

I definitely agree to publish it in the hosted suppression file. I opened a PR for this one because it was an old suppression issue prior to the introduction of the github action. Based on the github action code, I guess the only way to do it, is for me to create new github issues to trigger the bot and approve them this way?

If you confirm it, I can proceed this way and close this PR which will become unnecessary. 🙂

[aikebah]

@nhumblot Yes, FP Report is (almost) the only way to do it.

The work-around I've used sometimes when there were still other proper FP reports ready to approve is a direct commit to the generatedSuppressions branch. But that would require another approvable FP-report on which (after approval) trigger the false-positive approval Github workflow that will use it to publish the updated hostedSuppressions file based on the generatedSuppressions.xml of that branch.

[nhumblot]

@aikebah Thanks for the additional explanation. Both suppression rules got added to the hosted suppression file through #5802 & #5803 🙂

[aikebah]

superseded by the hosted suppressions file additions