fix(scanner): scope OpenVSX extension OSV lookups to marketplace ecosystem

[syf2211]

Summary

Scope Insights API v2 vulnerability lookups for VS Code and OpenVSX extension packages to their marketplace-specific OSV ecosystems, preventing npm malware advisories with colliding package names from being applied to extensions during vet scan --vsx.

Motivation

Fixes #730. When scanning OpenVSX extensions (e.g. llvm-vs-code-extensions.vscode-clangd), vet could incorrectly flag them as verified npm malware because OSV lookups were not scoped to the extension marketplace. The underlying npm package with a similar name is unrelated to the OpenVSX extension.

OSSF malicious-packages uses separate OSV ecosystems:

• vscode — VS Code Marketplace
• vscode:open-vsx.org — OpenVSX registry

Changes

• Add models.GetOsvEcosystem() mapping internal extension ecosystems to OSV identifiers
• Extract buildInsightsV2Request() and pass OsvEcosystem for extension packages in Insights API v2 enrichment
• Add unit tests for mapping and request construction

Tests

go test ./pkg/models/... ./pkg/scanner/... -run 'TestGetOsvEcosystem|TestBuildInsightsV2Request' -count=1

Result: all tests passed.

Notes

• This is a client-side scoping fix; control-tower must honor OsvEcosystem for malware/OSV lookups (same field already used for distro scoping).
• Insights v1 path is unchanged; Insights v2 is the default enrichment path.
• Did not run a full end-to-end vet scan --vsx against a live machine with the reported extension installed (no local extension fixtures with the collision case).

[safedep]

SafeDep Report Summary

No dependency changes detected. Nothing to scan.

View complete scan results →

_{This report is generated by SafeDep Github App}

[abhisek]

@KunalSin9h Can you please review this. Looks like an important fix.

[KunalSin9h]

@syf2211 go linter is failing, please fix that.

Error: pkg/scanner/enrich_insightsv2_test.go:56:1: File is not properly formatted (gci)
  			Manifest: models.NewPackageManifestFromLocal("lib/apk/db/installed", ecosystem),
  ^
  1 issues:
  * gci: 1

not a big deal, if you can't then leave it.

[syf2211]

Fixed the gci formatting issue in enrich_insightsv2_test.go (struct field alignment). Pushed in 966a815.

[KunalSin9h]

@syf2211 thanks for contribtion.