gopls/internal/vulncheck: limit the included callstack count

There can be a thousand callstacks. Currently the limit is 64.

Maybe we can do a better job to filter and choose the important
callstacks. For example, if we analyze A, B, C packages,
and get three callstacks when we want to report only 1,

  A -> B -> V
  C -> B -> V
  B -> V

one can favor B->V because that's where fixing needs to happen.

Change-Id: I0d27a74fd8743629b6845c8d01b01320442d4cd7
Reviewed-on: https://go-review.googlesource.com/c/tools/+/395674
Trust: Hyang-Ah Hana Kim <hyangah@gmail.com>
Run-TryBot: Hyang-Ah Hana Kim <hyangah@gmail.com>
Reviewed-by: Jonathan Amsterdam <jba@google.com>
gopls-CI: kokoro <noreply+kokoro@google.com>

gopls/internal/vulncheck/util.go

@@ -40,8 +40,12 @@ func fixedVersion(info *osv.Entry) string {
 	return fixed
 }
 
+const maxNumCallStacks = 64
+
 func toCallStacks(src []vulncheck.CallStack) []CallStack {
-	// vulncheck.CallStack
+	if len(src) > maxNumCallStacks {
+		src = src[:maxNumCallStacks]
+	}
 	var dest []CallStack
 	for _, s := range src {
 		dest = append(dest, toCallStack(s))