Add vulnerable example to test annotations

[imjasonh]

Summary

This PR adds a vulnerable example to demonstrate the govulncheck action's capabilities and includes several enhancements to improve vulnerability reporting and user experience.

🎯 Key Features Added

1. Vulnerable Example

   • Added example/ directory with code that intentionally uses a vulnerable version of golang.org/x/net
   • Demonstrates real vulnerability detection in action
   • Shows how annotations appear on both go.mod and source code

2. Enhanced Annotations

   • Rich context including vulnerability summaries, CVE numbers, and fix recommendations
   • Direct links to Go vulnerability database (pkg.go.dev/vuln)
   • Proper file path handling for subdirectories
   • Shows the actual vulnerable function being called (e.g., "html.Parse" not "main")

3. Suggested Fixes

   • When vulnerable code is actually called, creates notice annotations
   • Shows current vs suggested dependency versions
   • Lists which specific vulnerabilities have active call sites

4. Workflow Summary

   • Comprehensive report using GitHub Actions summary API
   • Formatted tables showing vulnerabilities by module
   • Vulnerable code locations organized by file
   • Clear upgrade recommendations

📸 What It Looks Like

When the action runs on the example, it will:

• ⚠️ Create warning annotations on vulnerable modules in go.mod
• 🚨 Create warning annotations on code that calls vulnerable functions
• 🔧 Suggest specific version updates when vulnerabilities are actively used
• 📊 Generate a detailed workflow summary with all findings

🧪 Test Plan

The PR includes a workflow that runs on the vulnerable example. You can see:

• Annotations appear on the correct lines in go.mod and main.go
• Vulnerability details include links and CVE numbers
• Suggested fixes show the exact version to update to
• Workflow summary displays a comprehensive report

🐛 Bug Fixes Included

• Fixed JSON parsing to handle both JSON lines and multi-line JSON formats
• Fixed annotation file paths when running in subdirectories
• Improved extraction of vulnerable function names from trace data
• Enhanced OSV detail parsing and storage

🤖 Generated with Claude Code