feat: new command "scan-source"

[luhring]

Adds a new experimental command to start letting us do source code scans of our distro packages. The goal here is to both:

1. find vulnerabilities that are otherwise obscured by our build process and thus not detectable in package/image scans
2. realize false positives via analyses like the call graph analysis in govulncheck that otherwise appear to be true positives in simple binary scans.

wolfictl scan-source [-d path/to/distro/dir] [-v] package

For now, this just uses govulncheck, wired in as a library. But in subsequent iterations we can add Grype or other scanners that will help surface findings in raw source code.

To finish this first iteration, there's a handful of tasks left to do:

• Support fetch pipelines (currently this just supports git-checkout pipelines)
• Consider using breakpoints or something similar to allow Melange pipeline configurations to specify the optimal scan point (it may be further into the pipeline than just after retrieving the upstream source code, particular if code or dependencies are modified)
• Tests
• Docs