Wait for BOM to be processed and scanned for vulnerabilities

[binarious]

I'm trying to implement what @stevespringett proposed in this GitHub issue comment. Currently, I'm uploading my BOM via /api/v1/bom and using the response token to check if it's still being processed by querying /api/v1/bom/token/$uuid. Only after this step is done, I upload my VEX. Unfortunately, this approach doesn't seem to work for larger projects, as the CVE analysis appears to be a separate task that needs to be completed before uploading the VEX file. Is there a way to check the security analysis status of a project/BOM?