Implement M1 scaffolding and OSV ingestion

[bjcorder]

Summary

Implements milestone 1: Scaffolding & OSV Ingestion.

• Implements M1.1: Initialize Go module and project structure #1 through M1.11: Wire up forkguard init and forkguard ingest #11.
• Adds Go module scaffolding, project layout, Apache headers, and CLI entry point.
• Adds lint/vet/test CI, CodeQL, Dependabot gomod coverage, security smoke checks, and repository templates/security policy updates.
• Adds cobra CLI stubs, viper configuration, slog logging, SQLite migrations/store, sqlc queries/generated code, OSV client, OSV normalization, and idempotent forkguard init / forkguard ingest.
• Includes review-driven hardening for OSV response/ZIP bounds, sanitized remote error bodies, CVSS severity fallback, transactional ingest, and security workflow self-match prevention.

Implementation commits

• c9506818a741 — Fix M1.1: Initialize Go module and project structure #1: Initialize Go module and project structure
• 3666ecace7f7 — Fix M1.2: Set up linting, vetting, and CI #2: Set up linting, vetting, and CI
• 484e61796505 — Fix M1.3: Create issue and PR templates #3: Create issue and PR templates
• 009c8c96e106 — Fix M1.4: Set up cobra root command and stub subcommands #4: Set up cobra root command and stub subcommands
• aadabd316f68 — Fix M1.5: Add viper-based configuration #5: Add viper-based configuration
• 6c4c9ee76afa — Fix M1.6: Set up slog-based structured logging #6: Set up slog-based structured logging
• 6c480c335441 — Fix M1.7: Set up SQLite store with golang-migrate #7: Set up SQLite store with golang-migrate
• 5bead2cc268e — Fix M1.8: Configure sqlc and write initial queries #8: Configure sqlc and write initial queries
• 94e2242fdc9f — Fix M1.9: Implement OSV API client #9: Implement OSV API client
• 5408252e1c09 — Fix M1.10: Implement OSV advisory normalization #10: Implement OSV advisory normalization
• ed39d2cdba42 — Fix M1.11: Wire up forkguard init and forkguard ingest #11: Wire up forkguard init and ingest
• 03c853a0fc67 — Fix M1.8: Configure sqlc and write initial queries #8: Make sqlc generation self-contained
• e7cc98508f2f — Fix M1.2: Set up linting, vetting, and CI #2: Enable Go security automation
• 4ec46ff9a990 — Fix M1.9: Implement OSV API client #9: Harden OSV client response handling
• 707689625be5 — Fix M1.10: Implement OSV advisory normalization #10: Derive severity from CVSS vectors
• a5dbbf6b5069 — Fix M1.11: Wire up forkguard init and forkguard ingest #11: Make OSV ingest transactional
• 8efdd1caaf3a — Fix M1.8: Configure sqlc and write initial queries #8: Format license header helper
• 8c6133db0dc0 — Fix M1.2: Set up linting, vetting, and CI #2: Prevent security smoke check self-match

Validation

• make generate — passed
• go build ./... — passed
• go vet ./... — passed
• go run github.com/golangci/golangci-lint/cmd/golangci-lint@v1.64.8 run ./... — passed
• go test ./... -race -coverprofile=coverage.out — passed
• pattern='(ghp_|github_pat_|sk-[A-Za-z0-9])'; ! git grep -nE "$pattern" -- ':!docs/**' ':!.github/workflows/security.yml' — passed
• ./forkguard --help — passed
• FORKGUARD_DB_PATH=<temp>/state.db ./forkguard init --forks <temp>/forks.yaml — passed
• FORKGUARD_DB_PATH=<temp>/state.db ./forkguard ingest --upstream github.com/openssl/openssl — passed
• Repeated ingest idempotency check — passed; counts remained 107 advisories and 259 fix commits
• Apache header grep for Go files — passed

Review

Fresh-context completion, code correctness, and source-code-only security reviews were run. Review findings were fixed and re-reviewed; no blockers or fixes worth doing now remained.

Risks / follow-ups

• GitHub CI has not completed until this PR runs.
• M2+ scan/report behavior remains intentionally stubbed and out of scope for M1.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.