Add a client to fetch vulnerabilities from osv.dev

[cuixq]

Something like internal/resolution/client/osv_client.go

This will be helpful for testing (mocking the client instead of fetching directly from OSV.dev API).