Update CHANGELOG.md for 1.6.0 (google#749)

Author: oliverchang

CHANGELOG.md

@@ -1,3 +1,41 @@
+# v1.6.0:
+
+### Features
+
+- [Feature #694](https://github.com/google/osv-scanner/pull/694)
+  Add support for NuGet lock files version 2.
+
+- [Feature #655](https://github.com/google/osv-scanner/pull/655)
+  Scan and report dependency groups (e.g. "dev dependencies") for vulnerabilities.
+
+- [Feature #702](https://github.com/google/osv-scanner/pull/702)
+  Created an option to skip/disable upload to code scanning.
+
+- [Feature #732](https://github.com/google/osv-scanner/pull/732)
+  Add option to not fail on vulnerability being found for GitHub Actions.
+
+- [Feature #729](https://github.com/google/osv-scanner/pull/729)
+  Verify the spdx licenses passed in to the license allowlist.
+
+### Fixes
+
+- [Bug #736](https://github.com/google/osv-scanner/pull/736)
+  Show ecosystem and version even if git is shown if the info exists.
+
+- [Bug #703](https://github.com/google/osv-scanner/pull/703)
+  Return an error if both license scanning and local/offline scanning is enabled simultaneously.
+
+- [Bug #718](https://github.com/google/osv-scanner/pull/718)
+  Fixed parsing of SBOMs generated by the latest CycloneDX.
+
+- [Bug #704](https://github.com/google/osv-scanner/pull/704)
+  Get go stdlib version from go.mod.
+
+### API Features
+
+- [Feature #727](https://github.com/google/osv-scanner/pull/727)
+  Changes to `Reporter` methods to add verbosity levels and to deprecate functions.
+
 # v1.5.0:
 
 ### Features