Distinguish vulns in direct vs transitive deps

GitHub Dependabot reports for Scala distinguish whether a vulnerability is in a direct or transitive dependency. `cabal-audit` does not show this information. ## Actual Behavior `cabal-audit` for `persistent` returns: ```text dependency "cryptonite" at version 0.30 is vulnerable for: HSEC-2025-0002 "Double Public Key Signing Function Oracle Attack on Ed25519" published: 2025-11-14 14:45:34 UTC https://haskell.github.io/security-advisories/advisory/HSEC-2025-0002 No fix version available crypto ``` but `cryptonite` is a transitive dependency via `cryptohash` ## Expected Something like: ```text dependency "cryptonite" at version 0.30 (transitive via cryptohash) ```