Add RustSec DB source

[wagoodman]

Add the ability to match rust crates against the RustSec DB https://github.com/rustsec/advisory-db

[westonsteimel]

@wagoodman, there is also https://github.com/google/osv which aggregates all of these sources using a common schema

[westonsteimel]

So how do we actually go about adding new data sources for grype? Is the existing process documented somewhere?

[westonsteimel]

~~Ah, so would it be somewhere in https://github.com/anchore/anchore-engine/tree/master/anchore_engine/services/policy_engine/engine/feeds?~~

No, I guess these are the legacy ones

[Shnatsel]

Hello, RustSec advisory DB maintainer here :wave:

RustSec uses a custom TOML-based format, but we also provide all advisories in the OSV format in real time. So if you support OSV already, supporting RustSec should be very easy. You can get the advisory data from Google's API or straight from our git repo.

RustSec uses SemVer precedence rules so matching should be quite straightforward.

Please let me know if you have any questions, run into any issues, etc.