Option to fail the build when an ignored CVE is no longer found

[yob]

We're using the new-ish support for ignoring CVEs that we're triaged as not relevant. It's great!

The lists of ignored CVEs are growing though, and we've noticed a few of them are no longer found in the images. Mostly due to fixes being released by the relevant linux distribution.

We'd love an option to fail the build if an ignored CVE is no longer found, to encourage us to tidy up the list incrementally. Would you be open to a PR that implements it?