Add a "verbose dry-run" mode to display what data is exchanged with OSV.dev

[andrewpollock]

google/osv.dev#1131 raised some questions rooted in confidentiality/privacy concerns around what information is shared with (and subsequently logged by) OSV.dev infrastructure.

I thought it would be helpful for privacy-conscious users of OSV Scanner to be able to reason about what data is being exchanged with OSV.dev if they could run OSV Scanner in a "verbose dry-run" where the API calls were displayed without sending anything to OSV.dev.