New data source: Homebrew

[andrew]

Homebrew publishes OSV-format advisory records at https://github.com/Homebrew/advisory-database under the Homebrew ecosystem with BREW- ids and pkg:brew purls. This issue tracks onboarding it as an osv.dev data source.

• Prepare your data — records validate against the OSV schema (checked on every push in the source repo)
• Create a PR to reserve an ID prefix and define a new ecosystem — Add Homebrew ecosystem ossf/osv-schema#576 (merged); URLs and version-ordering language in Homebrew: fill BREW database URLs and add version-ordering language ossf/osv-schema#580
• Prepare and publish your records via a Git repository — https://github.com/Homebrew/advisory-database (advisories/*.json)
• To support API querying, please create a PR to extend purl_helpers.py and create a new ecosystem in _ecosystems.py — see below
• Create a PR to start importing into source_test.yaml
• Create a PR to start importing into source.yaml

For the ecosystem/purl PR: pkg:brew maps to Homebrew with no namespace (EcosystemPURL('brew', None)). Version comparison is Homebrew's PkgVersion: an upstream version segment ordered by Homebrew's Version class, then a numeric _N revision suffix (e.g. 1.81.6_5 < 1.81.6_6 < 1.82.0). There isn't a Homebrew comparator in third_party/univers or osv-scalibr/semantic today so this needs a small new implementation; the _sort_key shape is (version_tokens, revision_int). Happy to also add the Go-side entries in go/osv/ecosystem/ and go/purl/ in the same PR if that's preferred over Python-only.

Proposed source_test.yaml entry:

- name: homebrew
  type: 0
  repo_url: https://github.com/Homebrew/advisory-database
  db_prefix: [BREW]
  accepted_ecosystems: [Homebrew]
  human_link: https://github.com/Homebrew/advisory-database/blob/main/advisories/
  link: https://raw.githubusercontent.com/Homebrew/advisory-database/main/advisories/
  directory_path: advisories
  extension: '.json'

Background: https://github.com/orgs/Homebrew/discussions/6869. pkg:brew was registered in package-url/purl-spec#796.

[MikeMcQuaid]

human_link: https://github.com/Homebrew/advisory-database/blob/main/advisories/
link: https://raw.githubusercontent.com/Homebrew/advisory-database/main/advisories/

let's use HEAD in these to future proof any branch name changes in future!