build: fix format and remove fix-state.

The run failed. So the .grype.yaml is being loaded.
Only set the vulnerability id. Ignore fix-state.

This will mean that I don't get a warning if it gets fixed,
but this is unlikely to be fixed.

Author: rouilj

.grype.yaml

@@ -1,5 +1,3 @@
 ignore:
-  - vlnerability: CVE-2018-20225
-    fix-state: not-fixed
+  - vulnerability: CVE-2018-20225
   - vulnerability: CVE-2018-20225-pip
-  fix-state: not-fixed