fix(osv-check): guard json.loads against non-JSON API responses

[annguyenNous]

Problem

_query_osv() in tools/osv_check.py calls json.loads(resp.read()) without a try/except guard. When the OSV API returns a non-JSON response (HTTP 502 HTML page, rate-limit response, or gateway error), this raises json.JSONDecodeError.

While the caller already catches Exception (fail-open pattern), handling this inside _query_osv() provides:

1. A clearer, more specific error message in debug logs
2. Returns the expected list type instead of raising
3. Follows the principle of handling errors close to the source

Fix

Wrap json.loads(resp.read()) in try/except json.JSONDecodeError, log at debug level, and return an empty list.

Diff: +5 lines, -1 line (1 file)

Testing

• Verified syntax: ast.parse() passes
• The fix is purely defensive — no behavior change for valid JSON responses
• Fail-open semantics preserved: empty list = no malware found = allow

[alt-glitch]

Subset of #29019 which already guards this exact json.loads() call in tools/osv_check.py along with several other unguarded sites (weixin, CDP, api_server) and adds atomic writes.