requirements.txt transitive traversal could potentially leak other files on the same image in CI

When running in CI, a malicious actor could open a PR with a requirements.txt file that links to other secret files that are formatted like requirements.txt (and match valid versions, so quite niche), and force osv-scanner to print out the contents (e.g. as a vulnerability report).

We should prevent this in two ways:

1. Defaulting to not setting ScanRoot to `/` (This is a breaking change)
2. Adding an extra flag to allow users to manually set the scan root.

Lodging this as a task for V3.

See https://github.com/google/osv-scalibr/issues/2323 for context.

Start by tracing how requirements.txt transitive traversal uses ScanRoot in osv-scanner, then read the context in osv-scalibr issue 2323. Define the default behavior and the extra flag for explicitly setting the scan root, including the breaking change. Done means CI scans cannot read unrelated same-image files by default while users can opt in deliberately.

Written by the indexing model from the issue text.