Update OSV and Scorecard certifier to new ontology and add unit tests

[pxp928]

• update root_package and source query to use graphql
• add unit tests for root_package and source query
• update unit test for OSV certifier
• add PkgToPurl helper function with unit tests
• Change certifier commands to use graphql client
• make client functions public
• how to handle OSV that is not CVE or GHSA?

cve, ghsa, err := helpers.OSVToGHSACVE(id.VulnerabilityId)

as this currently returns an error. Changed to be a log and not create the isVulnerability

[lumjjb]

lgtm - let's add a TODO with an issue for that conversion in the line around purl conversion.