Add dependency groups filter for PackageOverrides config

[kmohrf]

Hi,

I think it would be nice if the PackageOverrides config would support matches on the package dependency groups (dev, optional, etc). The simplest solution would be a simple exact match like it is used for name or ecosystem.

Examples:

Ignore a dependency group entirely

This may be useful for projects that don’t care about any issues in a certain dependency group.

[[PackageOverrides]]
dependency_group = "dev"
ignore = true

Ignore a package only if it is in a certain dependency group

This is useful if vulnerabilities for a package should only be ignored as long as the package is part of a certain dependency group. Example: One might want to ignore a package if it is a dev dependency but it should raise errors if it is a production dependency.

[[PackageOverrides]]
name = "axios"
ecosystem = "npm"
dependency_group = "dev"
ignore = true

Thanks for your work on osv-scanner!

Cheers

[cuixq]

@G-Rath do you think you would be interested to work on this as well?

[G-Rath]

I can at least have a look while I'm also looking at #1155