When running the tidy target:

• Pipe ouput into vuln.xml.tidy instead of stdout.
• Don't hide what command we are running so it's clear where the tidy version of the output went.