v0.3.0

Package inventory input: pass a CSV of packages (ecosystem,name,version or purl, plus owner or system columns) to check what an organisation already uses against OSV, with a per-package packages.csv and report section. Malicious releases are flagged. See CHANGELOG.md.