x/vulndb: check product data for module paths

[julieqiu]

For example, https://github.com/CVEProject/cvelist/blob/master/2020/7xxx/CVE-2020-7668.json lists the module path in its product data. It is not listed in the references section.

Also if there is a synk URL, we should check for the term GOLANG.

[gopherbot]

Change https://golang.org/cl/369745 mentions this issue: internal/worker: check product data for module paths

[gopherbot]

Change https://golang.org/cl/369746 mentions this issue: internal/worker: check synk.io URLs for GOLANG