OSV Scanner

Features: - Feature #2815 Add support for the CycloneDX 1.7 specification (bumps cyclonedx-go to v0.11.0). - Feature #2799 Enable .csproj and Central Package Management (nugetcpm) source scanning plugins by default. - Feature #2871 Extract and parse Alpine OS distro version (e.g. Alpine:v3.17, Alpine:edge) from PURL distro qualifiers to scan packages under their respective Alpine ecosystems. - Feature #2801 Enable the swift/packageresolved plugin by default to support SwiftURL vulnerability scans. - Feature #2666 Add a Docker-based variant of the pre-commit hook in .pre-commit-hooks.yaml to avoid local compilation. - Feature #2637 Add a new configuration setting ScanGoModVersion (disabled by default) to avoid parsing toolchain version directives directly from go.mod, preventing misleading warnings. - Feature #2772 Scan container images built with Canonical Chisel by enabling the os/chisel extractor plugin. Fixes: - Bug #2807 Sanitize package name, source, and version fields in the vertical output format to prevent GitHub Actions workflow command injection vulnerabilities from crafted lock files. - Bug #2876 Improve HTML scan report usability by supporting standard click modifiers (Ctrl/Cmd/middle click) to open vulnerabilities in new tabs, and preserving scroll position when switching tabs. - Bug #2783 Keep transitive dependency scanning enabled when specifying the --offline-vulnerabilities flag. - Bug #2808 Deduplicate equivalent OSV matcher requests before executing bulk queries to reduce API overhead. - Bug #2837 Prevent panics during offline matcher scans (e.g. on unsupported GitHub Actions ecosystem) by avoiding parsing errors when checking version ranges. - Bug #2836 Ensure the scanner returns an exit code of 0 when --help or -h is explicitly requested. Misc: - Update Go version to 1.26.4. - Update osv-scalibr to v0.4.6-0.20260612031204-164402d9140e. - Tag built Docker and GitHub Action images with the major version (e.g. :v2) to allow users to pin to a major version (#2857). New Contributors - @herdiyana256 made their first contribution in #2801 - @zhijie-yang made their first contribution in #2772 - @francose made their first contribution in #2837 - @rohan-patnaik made their first contribution in #2808 - @evilgensec made their first contribution in #2807 - @gotgolem made their first contribution in #2783 - @Khuzaimx made their first contribution in #2857 Full Changelog: v2.3.8...v2.4.0