feat: add vulnerability detection plugin using osv database - #10497

Fix #1055

This pull request introduces a new source/condition plugin to interact with the osv database.
The OSV database is a distributed database for open source vulnerabilities.
It allows to answer the following questions:

Condition:

• Does my dependency contains CVE (or not)?
  Sources:
• What's the lowest version that do not contain CVEs of severity CRITICAL

A dependency can be specified using its name and its ecosystem or with its purl url

remark:

• This source answers "which version fixes the known vulnerabilities?", not "which version is the latest?".
  fixedversion returns the lowest version clearing the advisories affecting version, so it is a security floor,
  not a release tracker, combine it with a source such as githubrelease when you also want to stay current.
• Its answers are only as good as osv.dev and deps.dev, which index published releases with some delay,
  so a very recent release may be missing or not yet linked to an advisory.

Here is an example

sources:
  jinja2-fixed:
    name: Get the lowest jinja2 version without known vulnerabilities from 3.1.2
    kind: vulnerability/osv
    spec:
      ecosystem: PyPI
      name: jinja2
      version: 3.1.2
  jinja2-ids:
    name: Get the known moderate or higher vulnerabilities of jinja2 3.1.2
    kind: vulnerability/osv
    spec:
      purl: pkg:pypi/jinja2
      version: 3.1.2
      key: ids
      minseverity: moderate

conditions:
  jinja2:
    name: Test that jinja2 3.1.2 has known vulnerabilities
    kind: vulnerability/osv
    disablesourceinput: true
    failwhen: true
    spec:
      ecosystem: PyPI
      name: jinja2
      version: 3.1.2
  jinja2-has-vul:
    name: Test that jinja2 3.1.2 has vulnerabilities
    kind: vulnerability/osv
    disablesourceinput: true
    failwhen: false
    spec:
      ecosystem: PyPI
      name: jinja2
      version: 3.1.2

Test

To test this pull request, you can run the following commands:

cd pkg/plugins/resources/osv/
go test
go build -o bin/updatecli . 
./bin/updatecli diff --config e2e/updatecli.d/success.d/osv.yaml

Additional Information

Checklist

• I have updated the documentation via pull request in website repository.
• I have tested this pull request manually with a custom Updatecli build and it works as expected.

Tradeoff

Potential improvement

Similar to OCI related plugin, the OSV database is an specific name that would be hard to detect for people unfamiliar with it. Maybe another name like "securityscanner" would be better

Summary by CodeRabbit

• New Features
  • Added OSV vulnerability scanning for supported package ecosystems.
  • Reports vulnerability IDs, severity, affected versions, and available fixed versions.
  • Identifies the lowest safe upgrade with ecosystem-specific version handling.
  • Supports minimum severity levels, ignored vulnerabilities, and package URL configuration.
  • Adds vulnerability conditions for flagging affected dependencies.
  • Provides changelog details for fixed and remaining vulnerabilities, with package version metadata where available.
• Bug Fixes
  • Improved vulnerability matching, alias handling, pagination, withdrawn-advisory filtering, and package-name normalization.