Add rootio provider for 🌱 Root CVE feed

[chait-slim]

What would you like to be added:
Adds a new provider that fetches vulnerability data from Root.io's OSV feed and transforms it for use with grype-db.

Why is this needed:
Allow any consumer of Root packages or images to correctly categorize affected and unaffected packages

Additional context:
Root Integration Proposal
Root operates as a transparent vulnerability patch provider that strongly embraces the open source philosophy. Rather than creating a proprietary ecosystem, Root functions as a supplementary provider that enhances existing open source distributions like Alpine, Debian, and Ubuntu. All of Root's patch development, testing methodologies, and vulnerability research are conducted with full transparency, and the company actively contributes back to the broader security community. This provider-first approach ensures that Root's patches complement rather than compete with official distribution maintainers, supporting the collaborative nature of open source security while providing additional coverage for time-sensitive vulnerabilities.

We are proposing a partnership that would enable Grype to optionally surface Root's vulnerability patches as a supplementary fix source alongside official distribution patches. Under this collaboration, when scanning container images or filesystems, Grype could provide visibility into Root's curated vulnerability fixes through a dedicated rootio:* namespace in the vulnerability database. This would help users discover when Root has developed patches for vulnerabilities that may not yet have official distribution fixes, offering additional remediation options within their existing security workflows. This foundational work demonstrates how Root's security patches could potentially be surfaced through Grype's scanning workflow while maintaining clear attribution and avoiding any conflicts with official distribution data, pending acceptance and refinement by the Grype maintainers.

[chait-slim]

I have created four PRs (including vulnerability-match-labels):
anchore/vunnel#963
anchore/grype-db#790
#3137
anchore/vulnerability-match-labels#167

All these follow the requirements proposed in the doc: https://docs.google.com/document/d/1w5MeoSNcYxpbXT8KIwa4xQirou4S0S-065VSu7YDkvg/edit?tab=t.0#heading=h.lmw7bb5yy8fd