Better support for profiles in transitive Maven pom.xmls

Edit: I've transferred this issue from osv-scanner, since the relevant logic would now live here.

osv-scanner scan would correspond to the pomxmlnet Extractor. osv-scanner fix is the guided remediation feature.

Currently, osv-scanner scan does not activate any Maven profiles(?), and osv-scanner fix activates only profiles that are explicitly active by default.

For better profile support, we could:

• Activate profiles that would naturally be activated (e.g. if the activation depends on a property)
• Have a way for the user to give us the active profiles (analogous mvn's --activate-profiles/-P flag)
  • Related: possibly have something analogous to mvn's --define/-D flag to define properties outside of the pom.xml file
• Figure out a way for getting/setting the JDK & OS versions for profile activation.

Start with the pomxmlnet Extractor and compare how osv-scanner scan and osv-scanner fix currently handle Maven profiles. Review the requested behavior for naturally activated profiles, user-supplied -P and -D values, and JDK or OS-based activation; done means agreeing on and implementing a defined profile-activation approach.