Ruletype to evaluate PRs with OSV data using data sources

[mesembria]

User Story Description

As a rulewriter, I should be able to evaluate new dependencies using OSV as a data source.

Acceptance Criteria

• Given that OSV is an external service
  when I write a ruletype
  then I should not be required to add custom go code
• Given that we have no support for secrets
  when I write a ruletype
  i should not be required to define any authentication