Integrate malicious package database into vulndb

[timbastin]

https://github.com/ossf/malicious-packages

I think we can just download the repo zip and iterate over all packages - like we do for the osv in general.

[timbastin]

The solution should be even simpler. We are already synchronising the osv database. It does provide "MAL-*.json" files. I think currently we filter those and only save cves.

[seb-kw]

Closing as duplicated: https://github.com/l3montree-dev/devguard/issues/53