feat(tools/osv): query OSV.dev for vulnerability cross-references during security triage

Add `tools/osv/` as a read-only bridge to **OSV.dev** (Google's open-source vulnerability database). Complements the existing `tools/cve-org/` and `tools/vulnogram/` by providing OSV's per-ecosystem (PyPI, npm, Maven, Go, RubyGems, crates.io, Packagist, …) vulnerability records.

**Suggested capabilities:**

- `query --package --ecosystem ` — list known vulns for a package
- `query --commit --repo ` — does a commit fix or introduce a known vuln?
- `vuln ` — full record (references, affected ranges, fix commits, aliases including CVE/GHSA)
- `aliases ` — cross-walk CVE ↔ GHSA ↔ OSV (the alias graph is the most valuable single piece of OSV)

**Why:** During `security-issue-triage`, before allocating a CVE, it's high-value to check whether OSV already has a record — to detect duplicates, to find the matching GHSA, and to find which downstream consumers are already warned. OSV is the **best machine-readable vulnerability cross-reference** available, and integrates cleanly with the existing CVE workflow.

Concrete consumers:

- `security-issue-triage` — early dedupe against the known-vuln set
- `security-issue-deduplicate` — alias resolution before merging trackers
- `security-cve-allocate` — sanity check that no existing OSV/GHSA already covers the report

**Reference:**

- OSV API: https://google.github.io/osv.dev/api/
- Existing CVE / vulnerability tooling: [`tools/cve-org/`](../tree/main/tools/cve-org/), [`tools/vulnogram/`](../tree/main/tools/vulnogram/)