new --audit option for sbom output

query OSV API for vulnerabilities and (just) print a summary