osv-scanner.toml package override ignored by github action

[gingerbenw]

When using osv-scanner configuration toml, ignored vulnerabilities are honoured by the github action, but ignored packages are not. This configuration works when running the osv-scanner tool locally, so I believe this may be an issue with the action.

Example repo here

[spencerschrock]

Scorecard respects that configuration it at HEAD, but not at v5.0.0 which is what v2.4.0 of this action uses. So this is likely something that was fixed/introduced in an update to osv-scanner which hasn't made it here yet.

We are trying to cut a new release(see #1478 and #1473), but I'm trying to get ossf/scorecard#4474 merged first.

[gingerbenw]

@spencerschrock Thanks for the quick response! I'll keep an eye out and check it out in the next release. 👍🏻