google/osv-scanner ? reverse-engineered prompt

Build me a Go command line tool called osv scanner that helps me check a project for known security issues in its dependencies.

I want to point it at a source folder and have it find common package files like lockfiles and manifests, then report any vulnerabilities it finds using OSV data. It should also be able to scan container images, check dependency licenses, and work offline after downloading the vulnerability database once. If possible, include a guided fix mode that suggests safer dependency upgrades instead of just listing problems.

Make the output easy to read from the terminal, with clear severity, affected package, and suggested next steps. It should support common ecosystems like Go, Node, Python, Java, Ruby, Rust, PHP, and others where reasonable. If you need current details, look up the latest docs online while you build it.