feat: enable .csproj and nugetcpm source scanning - #2799

osv-scanner 2.4.0

Created-by: HarmonybrewBot
Commit-by: HarmonybrewBot
Merged-by: HarmonybrewBot
Description: Created by `brew bump`

---

Created with `brew bump-formula-pr`.<details>
  <summary>release notes</summary>
  <pre>### Features:

- [Feature #2815](google/osv-scanner#2815) Add support for the CycloneDX 1.7 specification (bumps `cyclonedx-go` to v0.11.0).
- [Feature #2799](google/osv-scanner#2799) Enable `.csproj` and Central Package Management (`nugetcpm`) source scanning plugins by default.
- [Feature #2871](google/osv-scanner#2871) Extract and parse Alpine OS distro version (e.g. `Alpine:v3.17`, `Alpine:edge`) from PURL `distro` qualifiers to scan packages under their respective Alpine ecosystems.
- [Feature #2801](google/osv-scanner#2801) Enable the `swift/packageresolved` plugin by default to support SwiftURL vulnerability scans.
- [Feature #2666](google/osv-scanner#2666) Add a Docker-based variant of the pre-commit hook in `.pre-commit-hooks.yaml` to avoid local compilation.
- [Feature #2637](google/osv-scanner#2637) Add a new configuration setting `ScanGoModVersion` (disabled by default) to avoid parsing toolchain version directives directly from `go.mod`, preventing misleading warnings.
- [Feature #2772](google/osv-scanner#2772) Scan container images built with Canonical Chisel by enabling the `os/chisel` extractor plugin.

### Fixes:

- [Bug #2807](google/osv-scanner#2807) Sanitize package name, source, and version fields in the vertical output format to prevent GitHub Actions workflow command injection vulnerabilities from crafted lock files.
- [Bug #2876](google/osv-scanner#2876) Improve HTML scan report usability by supporting standard click modifiers (Ctrl/Cmd/middle click) to open vulnerabilities in new tabs, and preserving scroll position when switching tabs.
- [Bug #2783](google/osv-scanner#2783) Keep transitive dependency scanning enabled when specifying the `--offline-vulnerabilities` flag.
- [Bug #2808](google/osv-scanner#2808) Deduplicate equivalent OSV matcher requests before executing bulk queries to reduce API overhead.
- [Bug #2837](google/osv-scanner#2837) Prevent panics during offline matcher scans (e.g. on unsupported `GitHub Actions` ecosystem) by avoiding parsing errors when checking version ranges.
- [Bug #2836](google/osv-scanner#2836) Ensure the scanner returns an exit code of `0` when `--help` or `-h` is explicitly requested.

### Misc:

- Update Go version to 1.26.4.
- Update `osv-scalibr` to `v0.4.6-0.20260612031204-164402d9140e`.
- Tag built Docker and GitHub Action images with the major version (e.g. `:v2`) to allow users to pin to a major version (#2857).

## New Contributors
* @herdiyana256 made their first contribution in google/osv-scanner#2801
* @zhijie-yang made their first contribution in google/osv-scanner#2772
* @francose made their first contribution in google/osv-scanner#2837
* @rohan-patnaik made their first contribution in google/osv-scanner#2808
* @evilgensec made their first contribution in google/osv-scanner#2807
* @gotgolem made their first contribution in google/osv-scanner#2783
* @Khuzaimx made their first contribution in google/osv-scanner#2857

**Full Changelog**: https://github.com/google/osv-scanner/compare/v2.3.8...v2.4.0</pre>
  <p>View the full release notes at <a href="https://github.com/google/osv-scanner/releases/tag/v2.4.0">https://github.com/google/osv-scanner/releases/tag/v2.4.0</a>.</p>
</details>
<hr>

See merge request: Harmonybrew/homebrew-core!11903