feat: Go module (go.mod) dependency extraction for OSV scanning

[Copilot]

go.mod files were recognized as dependency manifests and triggered the deps aspect, but produced no extracted coordinates — resulting in false "no exact-version dependencies" skips for Go projects.

Extractor — src/scan/deps/extract/goMod.ts

• Parses both block require ( ... ) and single-line require module v1.2.3 forms
• Strips v prefix (e.g. v0.16.0 → 0.16.0) for OSV Go ecosystem compatibility
• Skips pseudo-versions (v0.0.0-20231113122135-abcdef012345) — no meaningful semver for OSV
• Includes direct and indirect deps; deduplicates via shared helper
• Exports GO_ECOSYSTEM = "Go" constant

Dispatcher — src/scan/deps/extract.ts

• Adds go.mod → extractGoModDependencies case

Example fixture — examples/deps/go/mod-app/go.mod

Two packages with known OSV advisories:

• golang.org/x/crypto v0.16.0 — CVE-2023-48795 (Terrapin, fixed ≥ v0.17.0)
• github.com/go-jose/go-jose/v3 v3.0.0 — CVE-2024-28176 (fixed ≥ v3.0.3)

Tests

Six new unit tests covering block/single-line requires, pseudo-version skipping, malformed input, deduplication, and line-number accuracy. One fixture integration test in depsExamples.test.ts.

[Copilot]

Pull request overview

Adds a go.mod dependency extractor so Go projects produce exact-version coordinates for OSV scanning, wired through the manifest dispatcher and exercised by unit and fixture tests.

Changes:

• New extractGoModDependencies extractor handling block and single-line require forms, stripping v prefix and skipping pseudo-versions.
• Dispatcher updated to route go.mod files to the new extractor.
• New example fixture, README entry, and tests (6 unit + 1 fixture).

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/scan/deps/extract/goMod.ts	New Go module parser producing Go ecosystem coordinates.
src/scan/deps/extract.ts	Routes go.mod manifests to the new extractor.
examples/deps/go/mod-app/go.mod	Fixture with two vulnerable + one indirect dep.
examples/deps/README.md	Documents new Go fixture entries.
tests/depsExtraction.test.ts	Unit tests for block/single-line/pseudo/malformed/dedup.
tests/depsExamples.test.ts	Fixture integration test for Go coordinates.