Document how to run osv-linter

[star-szr]

In #148 osv-linter is mentioned, but we (myself, @sensespidey, and @ergonlogic) could not find documentation on how to run/use that tool.

We tracked down https://github.com/ossf/osv-schema/tree/main/tools/osv-linter and were able to get it running, but maybe this would be a good addition to CONTRIBUTING.md.

We assume passing osv-linter is one of the goals of this project, so along these lines we would suggest additional issues around:

• Running osv-linter in CI
• Updating the codebase so that the resulting advisories pass the osv-linter

Happy to create these issues, but being new to the project don't want to go too far without hearing from the existing maintainers.

[G-Rath]

Yup that's what I'm working on right now - we've only just gotten the database added to the OSV schema, so I'm now working on the next steps including reviewing the linter

[star-szr]

For the record, here's what we did:

• Installed Go using the instructions at https://go.dev/doc/install
• Cloned https://github.com/ossf/osv-schema
• cd into the osv-schema repo
• cd tools/osv-linter
• go run ./cmd/osv record lint ../path/to/drupal-advisory-database/advisories

[G-Rath]

yup that sounds about right - you can also see the linter being run by osv.dev here for test and here for production (usually, right now its not reporting any Drupal findings which I think is because of some processing results due to a recent wave of advisories being published).

fwiw I've also just drafted ossf/osv-schema#453 to support running the linter in parallel which can greatly speed things up