Make dependency/cves check pluggable (and thin data)

As downloading CVE data can be flaky we shifted this to only happen once a day in #22161

the problem with this approach is that it forces download of the cve data even if you are not running the cves check

if you are using RBE this makes it download the data every time - and the data is quite large

i think we can use a bazel flag to tell the checker whether to include the cve data, and also thin the data a bit when it is downloaded by removing unused fields