feat: move Vanir signature generation to a cron job

[cuixq]

#4611

This PR introduces a new vanir_signatures worker to enrich OSV records with Vanir signatures. This cron job identifies modified vulnerabilities, generates the signatures, and updates both the Datastore and GCS with the enriched data.

• Identifies vulnerabilities modified since the last successful run by querying the Vulnerability Datastore index, ensuring efficient updates.
• Utilizes the vanir library to perform batch processing of OSV records, generating signatures for any vulnerability that includes a GIT affected range.
• Filtering:
  • Excludes records without GIT-based repository information.
  • Excludes Linux Kernel vulnerabilities (identified by package name or repository URL).
  • Ensures signatures are only generated for active (non-withdrawn) records.
• Uses ThreadPoolExecutor to handle parallel I/O for fetching records from GCS and managing batch processing.
• Enriched records are synchronized back to GCS (as the primary storage for full protos) and the Datastore index (to maintain accurate modification timestamps and status metadata).
• Includes a --dry-run flag for testing the workflow without modifying production data.
• Introduces modify_storage_client_adapters to configure the GCS client with an increased HTTPAdapter connection pool and retries.

Currently the crob job is scheduled daily at 9:00 AM Sydney time which we may want to adjust to run more frequent later.

[cuixq]

/gemini review

[cuixq]

/gemini review

[cuixq]

/gemini review

[michaelkedar]

This looks mostly good to me, I'm just a bit concerned on how gracefully errors are handled in general

[another-rex]

From our offline discussions:

• Add a vanir generation modified date so that we can track what version of this vuln record the vanir generation is for (so we know to skip it when regening)
• For the initial merge, let's just skip all records that already have vanir signatures, because it's going to take far too long to do. Reenable regening once we have the vanir git optimisations

[another-rex]

Just looked at the last change, which LGTM. Just 1 question.