fix: offline scanning having different results than online

[another-rex]

This fixes offline scanning having different results compared to using the API. Seems to have two causes:

• vulnerabilities.Include function tests whether a vulnerability is included in aliases as well, and offline scanning skips those vulns if it is included in aliases. However, this is not the behavior of online scanning, where we return all records that match and do not skip alised vulns.
• osv.dev query code has a special section to edit stdlib versions without a patch version to always assume it's at the max patch version. This code is not replicated in offline matcher code.
  • I initially placed it in the query code because I didn't want to show the patched version in the output. But I think it's probably a good thing that we show how we are interpreting a version rather than silently patching it, so moved it out to our PackageInfo struct.

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 69.31%. Comparing base (5d239bf) to head (5875aa0).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1566      +/-   ##
==========================================
- Coverage   69.34%   69.31%   -0.04%     
==========================================
  Files         200      200              
  Lines       19059    19029      -30     
==========================================
- Hits        13216    13189      -27     
+ Misses       5135     5133       -2     
+ Partials      708      707       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[hogo6002]

LGTM, just need to remove the unused functions.