Extend Vulnerabilities check with https://github.com/github/advisory-database

[naveensrinivasan]

Is your feature request related to a problem? Please describe.
Scorecard does vulnerability scan with osv.dev. Recently GitHub OSS their Vulns https://github.com/github/advisory-database. It would be nice if scorecard can check with this DB for reporting any issues.

[naveensrinivasan]

Related G-Rath/osv-detector#3

[G-Rath]

@naveensrinivasan osv-detector is at a pretty good point now that I think it should be usable here - I'm wondering if it could be used as a binary to avoid having to duplicate all the manifest/lockfile finding stuff, and then scorecard could parse its json output. Would that work?

[github-actions]

This issue is stale because it has been open for 60 days with no activity.

[spencerschrock]

This was implemented back in #2509 via osv-scanner, which has the GitHub Advisory Database