Remediate RC6 container scan findings

scripts/verify_security_exceptions.py

@@ -40,12 +40,23 @@ def load_and_validate() -> tuple[dict[str, object], list[str]]:
             if not isinstance(item, dict) or len(str(item.get("reason", ""))) < 30:
                 errors.append("every advisory requires a specific reason")
                 break
+        aliases = [
+            str(alias)
+            for item in advisories
+            if isinstance(item, dict)
+            for alias in item.get("aliases", [])
+        ]
+        if len(aliases) != len(set(aliases)) or any(
+            not alias.startswith("CVE-") for alias in aliases
+        ):
+            errors.append("container aliases must be unique CVE identifiers")
     return payload, errors
 
 
 def main() -> int:
     parser = argparse.ArgumentParser()
     parser.add_argument("--print-ids", action="store_true")
+    parser.add_argument("--print-container-ids", action="store_true")
     args = parser.parse_args()
     payload, errors = load_and_validate()
     if errors:
@@ -55,6 +66,10 @@ def main() -> int:
     if args.print_ids:
         for item in payload["advisories"]:
             print(item["id"])
+    elif args.print_container_ids:
+        for item in payload["advisories"]:
+            for alias in item.get("aliases", []):
+                print(alias)
     else:
         print(
             "Dependency exceptions valid through "