consider putting details about errors in `models.VulnerabilityResults`

This was discussed in: https://github.com/google/osv-scanner/pull/501#discussion_r1401646226

Return error codes don't seem to be the right way to report what combination of vulnerability, called vulnerabilities, license violations. It's simpler to just return 0 or 1, and put the details about what kinds of issues are present in the json or `models.VulnerabilityResults` output.