feat(os-pkg): add data sources

[afdesk]

Description

Add data sources to the result for OS packages.

$ trivy image --format json alpine:latest
...
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-2021-36159",
          "PkgName": "apk-tools",
          "InstalledVersion": "2.12.4-r0",
          "FixedVersion": "2.12.6-r0",
          "SeveritySource": "nvd",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-36159",
          "DataSource": {
            "Name": "Alpine Secdb",
            "URL": "https://secdb.alpinelinux.org/"
          },
         ....
}

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).