osv-scanner: Callgraph analysis to help prioritize matched vulnerabilities

[oliverchang]

Meta-issue to track the feature of doing callgraph analysis as part of vulnerability scanning to help reduce false positives (or at least help prioritize vulnerabilities). Vulnerability databases are starting to include metadata about which functions need to be called to actually be considered vulnerable (GHSA, Go at the very least).

Related idea from @jonathanmetzman: We can even go further with this analysis: We can completely disable the vulnerable code path to completely remove any possibly of the vulnerability being reached.

Current open issues:

• Go: osv-scanner: integrate vulncheck #10

[another-rex]

Closing this as a duplicate of #476