Refactor bulk auditing

[woodruffw]

This refactors pip-audit-bulk into a Python script, which will hopefully be more readable and maintainable.

It also makes some changes to the outputs:

• The audits under the audits/ directory are still JSON, but the top-level structure is now the direct list of vulnerabilities. All extraneous keys and non-vulnerable dep information has been removed.

• The new "skipped" file lists subdependencies of each requirements file that are skipped by pip-audit. This usually indicates a mismatch between the resource name in the Homebrew formula and the actual PyPI package name, and should be fixable.

Signed-off-by: William Woodruff william@trailofbits.com

[woodruffw]

~Still WIP while I cut the diff down a bit (there's a bug, and I can make the indentation match to make the changes smaller).~

[CLAassistant]

All committers have signed the CLA.