Add document upload and review notes for vendors

[gearnode]

Currently, our vendor management system lacks the ability to store important compliance and security documents (such as SOC2 reports) directly with the vendor profile. Additionally, there is no structured way to add review notes when evaluating these documents. This makes vendor compliance tracking, security reviews, and audit preparation difficult and disconnected from our vendor data.

Extend the vendor data model to include:

1. Document upload functionality for compliance and security documents (SOC2 reports, etc.)
2. A notes system for documenting reviews of these materials
3. Metadata for uploaded documents including review status