x/vulndb: add link to importers of a package in new automated issues

The worker now includes a link in the automated issue description to pkg.go.dev/?tab=importedby for the affected module, as a starting point in detecting false positive vulnerability reports.

For golang/go#51944

Change-Id: I3caaaba69c07e7a3e24977cf5ea5e92559ce8628
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/402394
Reviewed-by: Julie Qiu <[email protected]>

Author: Tatiana Bradley

internal/worker/worker.go

@@ -301,6 +301,7 @@ func newCVEBody(sr storeRecord) (string, error) {
 	if r.Links.PR != "" {
 		fmt.Fprintf(&intro, "\n- PR: %s", r.Links.PR)
 	}
+	fmt.Fprintf(&intro, "\n- Imported by: https://pkg.go.dev/%s?tab=importedby", cr.Module)
 	for _, l := range r.Links.Context {
 		fmt.Fprintf(&intro, "\n- %s", l)
 	}

internal/worker/worker_test.go

@@ -227,6 +227,7 @@ a description
 Links:
 - NIST: https://nvd.nist.gov/vuln/detail/ID1
 - JSON: https://github.com/CVEProject/cvelist/tree//
+- Imported by: https://pkg.go.dev/a.Module?tab=importedby
 
 See [doc/triage.md](https://github.com/golang/vulndb/blob/master/doc/triage.md) for instructions on how to triage this report.