Show the vulnerable path when doing transitive dependency scanning

Currently we only show vulnerabilities for transitive dependencies but not the path how we depend on the vulnerable dependency. Considering the lack of lockfile for these ecosystem, it will be helpful to also show the vulnerable path (for example what `npm audit` does) when reporting the vulnerabilities.