Try to support CGO

Making this for visibility, feel free to edit and reframe

---

When `osv-scalibr` started to use a CGO library due to https://github.com/google/osv-scalibr/pull/1405, it [broke](https://github.com/google/osv-scanner/pull/2532#issuecomment-3942019624) Goreleaser. @erikvarga managed to [replace the library in `osv-scalibr`](https://github.com/google/osv-scalibr/commit/436cd8cae5b7b67b39472d72a08dfe8152fb23cf), but has indicated [it's unlikely we can avoid having CGO libraries in scalibr forever ](https://github.com/google/osv-scanner/pull/2532#issuecomment-3965645168):

> However, we have another PRP contribution that would like to use the library in a way that's harder to reimplement with just regexp parsing: https://github.com/google/osv-scalibr/pull/1444

This issue is to track how we deal with that