OSV-Scanner reporting package locations to give user information on remediation externally

Hi there !

First of all, thanks a lot for the work on this tool, it is really a pleasure to work with it.

Coming from Datadog, where we are using osv-scanner to scan our customer repositories to extract packages they use and later match packages with advisories to resurface vulnerabilities in our platform.

To do so, we only need packages as we use our own platform to match vulnerabilities, but we also need to have the location where it has been found when parsed (file and start/end line and column).

We started implemented this in [our fork](https://github.com/DataDog/osv-scanner), and I will work in the next months on creating PRs for each of them to be able to discuss them individually with you to check if it matches your vision for the future of this tool or not. (Don't hesitate to tell me if that suits you or if you would prefer me to do it in another way)

Here's a quick list of features we have implemented in our fork :
- Recursive parsing of maven files (mainly to be able to resolve more properties)
- Reporting packages in the CycloneDX 1.4 and 1.5 format
- Reporting location of the entire dependency definition for maven, go, requirements.txt, pipenv, poetry, yarn, npm and pnpm
- Reporting location of each components of the dependency definition (name and version) individually for the same ecosystem than above