Basic initial implementation of oss-fresh-tool.

[scovetta]

This PR contains an initial, basic implementation of a "freshness" calculator.

The goal is, for a given project (Package URL), to tell which versions are acceptable and which are not based on passed in criteria, like:

• The maximum age (in days) of a package if the project is still being maintained.
• The maximum age (in days) of a package if the project is NOT still being maintained.
• The maximum age (in versions) of a package.

[jpinz]

Any reason why you went with Libraries.io vs native metadata? I've been trying to get data from the source instead of from a 3rd-party service wherever possible. I'm guessing it was just an ease of use thing, quick for a POC.

[scovetta]

I went with libraries.io because it normalized data between ecosystems, so I didn't need to have special logic to handle npm vs. nuget vs. pypi. I'd certainly prefer native and doing normalization ourselves, but it's a bit more work.

[gfs]

I think it's fine with libraries.io for now. It's a much larger project than this to have a native api with standardized metadata.

[jpinz]

LGTM