Integrate Vanir

[oliverchang]

https://github.com/google/vanir is a system for

• Generating signatures for source code patches
• Detecting whether a local copy/fork of some code has patches applied, by using the signatures generated.

This seems very useful for the general C/C++ ecosystem, where vendoring/forking is very common. Today, our approach is to guess the closest upstream repository (tagged) commit, and key vulnerability matching based on vulnerable commit ranges (https://osv.dev/blog/posts/introducing-broad-c-c++-support/)

Vanir seems like an alternative approach that could work better.

@baekhyunwook

[github-actions]

This issue has not had any activity for 60 days and will be automatically closed in two weeks

See https://github.com/google/osv-scanner/blob/main/CONTRIBUTING.md for how to contribute a PR if you're interested in helping out.