Integrate Vanir

https://github.com/google/vanir is a system for

- Generating signatures for source code patches
- Detecting whether a local copy/fork of some code has patches applied, by using the signatures generated.

This seems very useful for the general C/C++ ecosystem, where vendoring/forking is very common. Today, our approach is to guess the closest upstream repository (tagged) commit, and key vulnerability matching based on vulnerable commit ranges (https://osv.dev/blog/posts/introducing-broad-c-c++-support/)

Vanir seems like an alternative approach that could work better.

@baekhyunwook