feat: add HTTP support for downloading DBs

[knqyf263]

Description

Add HTTP support in addition to OCI.

$ trivy image --scanners vuln --db-repository https://github.com/knqyf263/trivy-db/releases/download/v2/db.tar.gz alpine:3.20
2024-11-08T15:13:30+04:00       INFO    [vulndb] Need to update DB
2024-11-08T15:13:30+04:00       INFO    [vulndb] Downloading vulnerability DB...
2024-11-08T15:13:30+04:00       INFO    [vulndb] Downloading artifact...        location="https://github.com/knqyf263/trivy-db/releases/download/v2/db.tar.gz"
2024-11-08T15:13:34+04:00       INFO    [vulndb] OCI successfully downloaded    location="https://github.com/knqyf263/trivy-db/releases/download/v2/db.tar.gz"
2024-11-08T15:13:34+04:00       INFO    [vuln] Vulnerability scanning is enabled
2024-11-08T15:13:37+04:00       INFO    Detected OS     family="alpine" version="3.20.3"
2024-11-08T15:13:37+04:00       INFO    [alpine] Detecting vulnerabilities...   os_version="3.20" repository="3.20" pkg_num=14

DBs

• Vulnerability DB (--db-repository)
• Java DB (--java-db-repository)
• Misconfiguration Checks DB (--checks-bundle-repository)

Currently, misconfiguration checks DB don't support multiple repositories, so it's out-of-scope for this PR.

Caveat

I've implemented the progress bar, but the change was bigger than expected. I reverted the changes and will open another PR.

2024-11-08T15:13:30+04:00       INFO    [vulndb] Downloading artifact...        location="https://github.com/knqyf263/trivy-db/releases/download/v2/db.tar.gz"
55.21 MiB / 55.21 MiB [-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% 97.01 MiB p/s 800ms
2024-11-08T15:13:34+04:00       INFO    [vulndb] OCI successfully downloaded    location="https://github.com/knqyf263/trivy-db/releases/download/v2/db.tar.gz"

We might want to rename --db-repository to --db-locations or something like that, but we can discuss it later.

TODO

• Refactor OCI support
• Fix tests
• Add HTTP support
• Add progress bar (out of scope)
• Add unit tests
• Add integration tests

Related issues

• Close Add HTTP support for downloading HTTP #7891

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).