x/vuln: vulncheck should not surface vulnerabilities in fixed version

[tatianab]

Moved from golang/vulndb#991 (reported by @dev-gto):

Hi, while running the latest govulncheck

go: downloading golang.org/x/vuln v0.0.0-20220912202342-0ed43f12cb05

on a system with golang 1.18.6, it is actually reporting the following

Vulnerability #1: GO-2022-0969
HTTP/2 server connections can hang forever waiting for a clean
shutdown that was preempted by a fatal error. This condition can
be exploited by a malicious client to cause a denial of service.

Call stacks in your code:

  {stripped line here} calls net/http.Server.Serve

Found in: net/http@go1.18.6
Fixed in: net/http@go1.19.1
More info: https://pkg.go.dev/vuln/GO-2022-0969
However, I believe that this vulnerability affects versions 1.18.5 (included) and below, as well as 1.19.0
Therefore, 1.18.6 should not be affected.
https://pkg.go.dev/vuln/GO-2022-0969

[zpavlinovic]

This is tracked in #55035, so I will close it here for now.