feat(nvd): use go to upload NVD conversion to gcs upon conversion

[jess-lowe]

This PR introduces support for immediately uploading NVD conversion records to GCS instead of saving them locally and then syncing, leveraging helper functions discussed in #4984.
Additionally, it refactors the NVD converter to separate record generation from output handling and reorganizes the project's upload and GCS utilities.

Key Changes

NVD Converter

• Refactored output logic: Updated nvd.CVEToOSV to return the Vulnerability and Metrics objects instead of writing them to disk directly. This separates the conversion logic from the I/O handling.
• Added GCS Upload Support: Added -upload-to-gcs, -output-bucket, and -gcs-prefix flags to the NVD converter tool to support direct streaming to GCS.

Package Reorganization & Utilities

• Moved upload package: Relocated vulnfeeds/upload to vulnfeeds/conversion/writer to better fit the new output handling structure.
• New gcs-tools package: Added a general GCS utility package in vulnfeeds/gcs-tools providing functions like UploadToGCS, UploadFile, and DownloadBucket.

Other Converters

• Updated combine-to-osv and other converters (Alpine, Debian, etc.) to use the new writer package instead of the old upload package.

Why this is needed

• Performance/Storage: Avoids local disk space bottlenecks during large NVD conversions by streaming directly to Cloud Storage.
• Maintainability: Improves code modularity by separating conversion logic from output methods.

[another-rex]

We should make the gcs-tools repo generic to only uploading to GCS, but we shouldn't put CVE specific logic into here.

[another-rex]

If uploading to GCS is going to take a while, I would even put the multithreading / concurrency logic in here.
E.g. provide a function that will spin up X number of works, and a "gcs client" that just contains a channel.

Other code can pass the client to their code to upload.

Probably for a separate PR though.

[jess-lowe]

We should make the gcs-tools repo generic to only uploading to GCS, but we shouldn't put CVE specific logic into here.

Moved these into their own thing in conversion/writer

[jess-lowe]

If uploading to GCS is going to take a while, I would even put the multithreading / concurrency logic in here. E.g. provide a function that will spin up X number of works, and a "gcs client" that just contains a channel.

Other code can pass the client to their code to upload.

Probably for a separate PR though.

For uploading vulnerability records, this is too nuanced, hence it has its own thing in writer.VulnWorker, but with the NVD data this will be happening in the same thread that converts the record

[another-rex]

Nice, mostly looks good. Have you tested it locally and see how much faster it is compared to the script? (Probably not a big impact here, since locally we have a lot of threads compared to the cronjob)