This adds support for parsing uv.lock files which are TOML based and overall seem pretty straightforward - the main gotcha I came across was that they nest their "groups" table (called optional-dependencies) in the package array of tables (I think those are the right TOML terms), meaning it actually ends up getting stuck on the last "package" entry even though it is not package specific.

Beyond that, I think the main two areas that could do with expanding are:

• support for more exoitc dependencies such as git (I figured this out)
• support groups - it looks like uv only tracks the direct dependency that has been grouped, but does not mark transitive dependencies; however because it captures both top-level dependencies (in package.metadata) and package dependencies (in [[package]].dependencies) I think in theory we should be able to walk the tree ourselves to determine what dependencies belong in what group
  • I've not done that for now as I'm not 100% sure that'd be correct in every situation, and it feels like it should be fine to tackle in a dedicated PR (I also figure deps.dev can probably help here, which might be a more accurate or preferred alternative)

Resolves google/osv-scanner#1406