vulns/scanner: fall back to verbatim head URL for non-forge repos

[andrew]

Follow-up to #23080 per @p-linnane's post-merge feedback.

repo_url only normalises GitHub, GitLab and Codeberg, so formulae whose stable, head and homepage URLs are all hosted elsewhere were being skipped outright. On my machine that's bash, gmp, gnu-tar, go, make, openconnect and zsh, each of which has a non-forge head.

This restores the tap's last-resort fallback: when repo_url finds no supported forge, query OSV's GIT ecosystem with the source URL verbatim if its path yielded a tag, otherwise the head URL verbatim. OSV returns nothing for these hosts today, so this is parity with the tap and future-proofing rather than a detection change.

Before/after for the seven formulae above:

bash: https://git.savannah.gnu.org/git/bash.git @ 5.3.15
gmp: https://gmplib.org/repo/gmp/ @ 6.3.0
gnu-tar: https://git.savannah.gnu.org/git/tar.git @ 1.35
go: https://go.googlesource.com/go.git @ 1.26.5
make: https://git.savannah.gnu.org/git/make.git @ 4.4.1
openconnect: git://git.infradead.org/users/dwmw2/openconnect.git @ 9.21
zsh: https://git.code.sf.net/p/zsh/code.git @ 5.9.2

(all previously SKIPPED)

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include Hyperfine benchmarks.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• AI was used to generate or assist with generating this PR.

Written with Claude Code from the review feedback; I read the diff, confirmed the seven formulae now produce query targets via brew ruby, and ran brew lgtm locally.

---

[Copilot]

Pull request overview

This PR adjusts Homebrew::Vulns::Scanner target derivation so formulae hosted on non-supported forges (anything outside GitHub/GitLab/Codeberg) are no longer skipped outright, by falling back to using the non-forge head URL verbatim (or the source URL verbatim when a tag can be extracted from its path).

Changes:

• Add a last-resort fallback in Vulns::Scanner#build_target to use verbatim non-forge URLs (stable/SBOM URL when a tag can be extracted from the path; otherwise head URL).
• Add RSpec coverage for the new non-forge fallback behaviour in #build_target.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
Library/Homebrew/vulns/scanner.rb	Adds verbatim URL fallback logic when repo_url can’t normalize any candidate to a supported forge.
Library/Homebrew/test/vulns/scanner_spec.rb	Adds/extends specs to cover new fallback target derivation behaviour.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[MikeMcQuaid]

Looks good, thanks! A few style nits.