feat: rework combine-to-osv to begin to combine NVD and CVE5 OSV records (#4086)

### NVD Output Changes:
- Updates the NVD conversion to start outputting OSV records instead of
`PackageInfo`
- Changes the output location of NVD to no longer be in the 'parts'
directory

### `combine-to-osv` changes:
- reads in two file paths for NVD OSV data and CVE5 OSV data
- lists CVEIDs of Alpine and debian vulns and generates the 'upstream'
records for them too so they still have an upstream,
- somewhat intelligently tries to combine data between the records, with
a bias toward the CVE5 conversion.
- outputs the files.

Author: jess-lowe

deployment/clouddeploy/gke-workers/environments/oss-vdb-test/nvd-cve-osv.yaml

@@ -17,4 +17,4 @@ spec:
             - name: CPEREPO_GCS_PATH
               value: gs://osv-test-cve-osv-conversion/cpe_repos/cpe_product_to_repo.json
             - name: OSV_OUTPUT_GCS_PATH
-              value: gs://osv-test-cve-osv-conversion/parts/nvd
+              value: gs://osv-test-cve-osv-conversion/nvd-osv

deployment/clouddeploy/gke-workers/environments/oss-vdb/nvd-cve-osv.yaml

@@ -17,4 +17,4 @@ spec:
             - name: CPEREPO_GCS_PATH
               value: gs://cve-osv-conversion/cpe_repos/cpe_product_to_repo.json
             - name: OSV_OUTPUT_GCS_PATH
-              value: gs://cve-osv-conversion/parts/nvd
+              value: gs://cve-osv-conversion/nvd-osv