osv-linter additional checks

[andrewpollock]

Tracking for checks thought of, but yet to be implemented:

ranges

• range type is correct (SEMVER is valid, GIT is valid)

ecosystems

Package existence and package version existence for:

• AlmaLinux
• Alpine
• Android
• Bitnami
• CRAN
• Chainguard
• Debian
• GitHub Actions
• Go
• Hackage
• Hex
• Maven
• NuGet
• Packagist
• Pub
• PyPI
• Red Hat
• Rocky Linux
• RubyGems
• SUSE
• SwiftURL
• Ubuntu
• Wolfi
• crates.io
• npm
• openSUSE

[andrewpollock]

/cc @hogo6002 FYI

[hogo6002]

ranges

• range type is correct (SEMVER is valid, GIT is valid)

We can also use osv-scanner/semantic to do the following checks:

• affected versions are correct ecosystem versions (correct version format).
• version range is valid (fixed version != 0 && introduced version < fixed version).

[andrewpollock]

Additional ones around record metadata that occurred to me:

• published is <= modified
• modified is >= withdrawn

[andrewpollock]

Credit to @fgalilee for inspiring this one:

• references.url returns an acceptable (2xx, 3xx) HTTP response (see also https://github.com/CVEProject/automation-working-group/blob/master/meeting-notes/files/cve_reference_archival_reqs.md)