Add vulnerability, license and outdated helpers

[abhinavgautam01]

fixes #10

Summary

Adds shared enrichment helpers for the logic currently duplicated across consumers:

• Add OSV-backed vulnerability checking via CheckVulnerabilities, BulkCheckVulnerabilities and VulnerabilityClient
• Add shared VulnInfo, VulnerabilityQuery and VulnerabilityResult types
• Add CategorizeLicense for permissive/copyleft/unknown classification using SPDX normalization
• Add IsOutdated for version comparison
• Add VersionInfo.Yanked and populate it from direct registry lookups
• Document the new APIs in the README

Notes

The vulnerability client uses OSV by default, but supports injecting another vulns.Source. License categorization and outdated detection are local helpers, so they still work in direct/private registry environments.

Tests

go test ./...