Ambiguity for annotations in vuln attestation

[lumjjb]

In the vuln attestation, annotations are specified as an optional list, but the list is not typed.

Would this be a list of strings ["foo=bar"], or a struct
[ {{"key":"foo"}, {"value": "bar"}}], or a list of single maps? [{"foo": "bar"}]

scanner.result.[*].vulnerability.annotations, optional list

This is a list of key/value pairs where scanners can add additional custom information.