omit null xray request slices

[wangyusheng1985]

Changes

• omit unset slice filters from FilterVulnBody and FilterReport request JSON instead of sending null
• add the current OpenAPI xprocess_id field and CLI flag to vulnerability filtering
• reject unknown fields in PostVulnFilter --body, preventing xprocess_ids from being silently ignored
• omit unset custom POC update lists while preserving explicit empty arrays such as tags: []
• keep required delete request arrays unchanged
• add serialization and CLI regression tests

Why

X-Ray's Django REST Framework serializers accept omitted optional list filters but reject explicit null. The generated Go request models serialized nil slices as null, causing PostVulnFilter, PostReportFilter, and related request paths to fail with INVALID_PAYLOAD.

Impact

• minimal vulnerability and report filter requests now work normally
• existing populated list filters are unchanged
• explicit empty custom POC tag lists remain available for clearing tags
• invalid xprocess_ids input now fails locally; callers should use singular xprocess_id
• no configuration or credential changes

Root cause

The generated request models had inconsistent JSON tags and custom marshal structures for optional slices. The vulnerability model was also behind the current OpenAPI definition and omitted xprocess_id.

Checks

• task test
• task lint
• task build
• git diff --check
• test environment: PostVulnFilter minimal body, populated status slice, xprocess_id, and CLI flag paths
• test environment: PostReportFilter minimal body and populated status slice
• dry-run: custom POC update omits nil lists and preserves explicit empty lists