[feature] Update deps.dev collector to take advantage of the new API

[pxp928]

Is your feature request related to a problem? Please describe.

With the new release of the API for deps.dev -> https://blog.deps.dev/api-v3/

• Take advantage of the batch query support
• Utilizing purl when querying for information (no need to decompose the purl as we are currently doing)

guac/pkg/handler/collector/deps_dev/deps_dev.go

Lines 401 to 419 in e283206

	packageInput, err := helpers.PurlToPkg(purl)
	if err != nil {
	logger.Infof("failed to parse purl to pkg: %s", purl)
	return nil
	}
	// if version is not specified, cannot obtain accurate information from deps.dev. Log as info and skip the purl.
	if *packageInput.Version == "" {
	logger.Infof("purl does not contain version, skipping deps.dev query: %s", purl)
	return nil
	}
	component.CurrentPackage = packageInput
	err = d.collectAdditionalMetadata(ctx, packageInput.Type, packageInput.Namespace, packageInput.Name, packageInput.Version, component)
	if err != nil {
	logger.Debugf("failed to get additional metadata for package: %s, err: %v", purl, err)
	}

)

Describe the solution you'd like
upgrade the current deps.dev collector to use the latest API features

[pxp928]

@rakshitgondwal would you be interested in working on this?

[rakshitgondwal]

Sure @pxp928, I can take this up after #1710

[pxp928]

@rakshitgondwal have you started any work on this? If not, @nathannaveen would like to take it over.

[rakshitgondwal]

Hi @pxp928, nope I didn't get the time to do so, and sure someone else can take this over.

[nathannaveen]

Hey @pxp928, could I work on this?

[nathannaveen]

Recently I have been working on this issue, and realize that since the deps.dev v3alpha version isn't stable it won't exactly fit our needs.

---

For example, when doing a purl batch lookup https://docs.deps.dev/api/v3alpha/#purllookupbatch, if any of the repos passed to the batch request aren't contained in the deps.dev database, it returns nil.

So the only way to check whether a purl is contained in the deps.dev database is to manually do a purlLookup for each individual purl. Which removes our need for the purlLookupBatch.

This issues will probably disappear when the deps.dev/api/v3alpha becomes stable. But for now, this won't work for what we want.

---

Additionally, we directly use the osv-scanner repo.

guac/pkg/certifier/osv/osv.go

Line 27 in dad65eb

osv_scanner "github.com/google/osv-scanner/pkg/osv"

The issue with this, is that osv-scanner calls the deps.dev resolve API, which only works with deps.dev/api/v3 not v3alpha.

Note that I didn't realize we directly use the osv-scanner repo at the time of writing this issue #1947.

---

So I think the best way to go about this is to wait for the version to become stable and then implement it.

If you want to run some tests, this is the batch request that will return nil: main...nathannaveen:guac:nathan/depsdevNewAPI#diff-82819d87163ba23dd5d158849f788068d5eadd6e1818517c879ec08b0745131cR455