Enable the -soaap-vulnerable-vendors flag and add a demo to show it off (using ffmpeg's libavcodec as being a potentially vulnerable vendor lib)