Warn when a vulnerable package version is added as a dependency

[lpil]

Hex now contains information on CVEs that we can use to display warnings when used. Let's use this information to display a warning when a newly resolved version of a dependency is vulnerable.

We could also have a command for showing vulnerabilities for the current package versions.

Reference implementation for Elixir: hexpm/hex#1150

[ankddev]

I think I can work on this!

[lpil]

Wonderful, thank you!

[ankddev]

Well, this is harder than I would think, because for some reason returned Hex response does not follow scheme in their latest proto files. I think that I found my mistake

[ankddev]

The first part with support from hexpm library is done in #5900! Now we will need to add a warning when resolving such a package. The main thing we need to think about is that most of versions with advisories are retired too, so we need to permit resolving retired versions for this to work properly. After that implementing warning and subcommand will be trivial.