Certifier - OSV Scanner API for batch querying

[pxp928]

Currently, the OSV Scanner querying API is copied as an internal file. Working with upstream maintainers to determine a path forward to remove this file.

Continuation from PR comment:
#245 (comment)

cc @oliverchang

[pxp928]

Currently, OSV Scanner does not allow for a direct query for a package based on a purl. See: https://github.com/google/osv-scanner/blob/main/pkg/osvscanner/osvscanner.go#L261. Determine if there is an alternative method or if this can be added to upstream OSV scanner.

[pxp928]

FYI @lumjjb

[oliverchang]

Currently our actual OSV querying code is in an internal package: https://github.com/google/osv-scanner/blob/main/internal/osv/osv.go

@another-rex would it make sense to make some of these public so other tools can call the OSV API through our client?

[another-rex]

That can work, we can put it under v1 folder under pkgs so that it's public and if there are any breaking changes it easy to update.

[pxp928]

Awesome thanks @another-rex!

[another-rex]

This is now merged: google/osv-scanner#167, so the library should now be public:

"github.com/google/osv-scanner/pkg/osv"

[pxp928]

Thanks, @another-rex and @oliverchang!