Add zero-key OSV dependency intelligence

[ORANGINGS]

What changed

• Parse exact dependency versions from npm, Python, Rust, and Go lockfiles/manifests.
• Add optional, zero-key OSV querybatch enrichment for repository scans.
• Map OSV records back to exact package versions and source-file evidence.
• Include known vulnerabilities in text, JSON, SARIF, score calculation, and repository capability-drift reports.
• Add reusable OSV cache snapshots for deterministic offline CI.
• Fail closed when cache mode lacks package coverage or referenced vulnerability details.
• Add GitHub Action inputs for online or cache-backed vulnerability scans.
• Add deterministic offline fixtures and regression tests.
• Bump the package to 0.5.0.

Why

Repository behavior analysis and capability drift should be complemented by known-vulnerability intelligence from the exact dependency versions that actually ship. The core integration uses the free OSV API and does not require a paid API key.

Validation before publication

• 34 local pytest tests pass after applying the exact publication patch to a clean 0.4.0 tree.
• Python source and tests pass compileall.
• The cache-backed CLI fixture exits with code 2 and produces a vulnerability finding without network access.

The first PR job atomically applies the verified patch and removes the temporary publication files. The PR remains draft until the resulting source revision passes the regular Python 3.11–3.13 CI matrix and SARIF checks.