OSV-compatible batch query

OSV.dev /v1/querybatch compatible, so osv-scanner and other OSV clients can point at VDB. Up to 1000 queries, each {package: {purl} | {ecosystem, name}, version}; results come back in the same order as {vulns: [{id, modified}]}, and the full record is at GET /v1/vulns/{id}. A version is evaluated against each advisory's affected ranges; an advisory whose ranges cannot be evaluated is kept. commit queries are not supported and answer with no vulns.