Document the data and sources that OSV-Scanner uses

[cuixq]

OSV-Scanner sends data to various services for different purposes:

• OSV.dev for vulnerabilities
• deps.dev for license information and dependency resolution
• Maven registries for package and version metadata
• etc

We should document these data and their sources in README.