feat(ignore): make id optional in .trivyignore.yaml to ignore all findings for a PURL/path

[knqyf263]

Description

Make the id field optional in .trivyignore.yaml so that users can ignore all findings matching a given purls or paths entry, without listing every individual ID.

Motivation

In discussion #10414, a user wants to ignore all vulnerabilities for the linux-libc-dev package (500+ CVEs).

Currently, .trivyignore.yaml requires id and performs strict equality matching (pkg/result/ignore.go:90):

if id != finding.ID {
    continue
}

This means users must enumerate every CVE ID, which is impractical for packages with hundreds of known vulnerabilities. The existing purls: field only narrows the scope of an already-matched ID; it cannot be used on its own.

Proposal

Allow id to be omitted. When id is empty, the entry matches any finding that satisfies the remaining filters (purls and/or paths).

Example

vulnerabilities:
  - purls:
      - "pkg:deb/ubuntu/linux-libc-dev"
    statement: Kernel headers, not exercised at runtime
    expired_at: 2026-12-31

misconfigurations:
  - paths:
      - "test/fixtures/**"
    statement: Test fixtures, safe to ignore

Matching logic

Update IgnoreFindings.Match so that an empty finding.ID skips the ID equality check:

if finding.ID != "" && id != finding.ID {
    continue
}

Validation

To prevent accidental suppression of all findings, reject entries where id, purls, and paths are all empty. This validation should run during YAML parsing so that misconfigurations fail fast with a clear error.

Scope of each scanner

Scanner	paths	purls	Filters usable when id is empty
Vulnerability	v	v	paths, purls
Misconfiguration	v		paths
Secret	v		paths
License	v		paths

purls remains vulnerability-only per the existing spec.

Additional considerations

• The legacy plain-text .trivyignore format is unaffected (id remains the only valid content).
• show-suppressed output is unaffected: it displays the actual detected finding ID (e.g., vuln.VulnerabilityID), not IgnoreFinding.ID.
• Docs and JSON schema need updates:
  • docs/guide/configuration/filtering.md: change the id row from Required: v to a note that at least one of id/purls/paths is required.
  • schema/trivy-config.json if applicable.
  • The // required: true comment on ignore.go:29.

Alternatives considered

Wildcard id (e.g., id: "*" or id: "CVE-*"): more flexible but adds a new matching mode to maintain. Making id optional is simpler and composes naturally with the existing purls/paths filters.

Backward compatibility

Non-breaking. Existing .trivyignore.yaml entries that specify id continue to work unchanged.