The `cosign-vuln` value is not listed in README as a possible value for `format` despite it being supported and available in Trivy.