Fix: Parser fails to detect vulnerabilities in multi-line JSON output

## Problem
The govulncheck action was incorrectly reporting "no vulnerabilities found" even when
vulnerabilities were present. This was happening because govulncheck outputs pretty-printed
JSON (multi-line format) rather than JSON lines format.

## Root Cause
The parser had a logic bug where it would set `parsedAsJsonLines = true` whenever it
encountered ANY valid JSON line, including trivial ones like `{`. This prevented the
multi-line JSON parser from ever running, causing all findings to be missed.

## Solution
Changed the parser to only skip multi-line parsing if it actually found meaningful data
(OSV details or findings) in JSON lines format. Now it correctly falls back to multi-line
JSON parsing when needed.

## Additional Changes
Updated the example workflow to fail if no vulnerabilities are detected, since we know
the example code contains vulnerabilities. This serves as a regression test to ensure
the parser continues to work correctly.

## Testing
- Verified the parser now correctly identifies 8 vulnerabilities in the example code
- The action now properly reports vulnerabilities instead of false negatives
- CI checks are now working correctly
- Example workflow now fails if the parser bug resurfaces

This is a critical bug fix that prevents false "no vulnerabilities" reports.

Signed-off-by: Jason Hall <jason@chainguard.dev>

lib/parser.js

@@ -8,24 +8,25 @@ class VulnerabilityParser {
     console.log(`Parsing ${lines.length} lines of govulncheck output`);
     
     // Try to parse each line as JSON first (JSON lines format)
-    let parsedAsJsonLines = false;
+    let foundValidData = false;
     for (const line of lines) {
       try {
         const json = JSON.parse(line);
-        parsedAsJsonLines = true;
         if (json.osv) {
           // Store OSV details
           osvDetails[json.osv.id] = json.osv;
+          foundValidData = true;
         } else if (json.finding) {
           console.log(`Found vulnerability: ${JSON.stringify(json.finding.osv || json.finding)}`);
           vulnerabilities.push(json);
+          foundValidData = true;
         }
       } catch (e) {
         // Skip non-JSON lines
       }
     }
     
-    if (!parsedAsJsonLines) {
+    if (!foundValidData) {
       // Parse as multi-line JSON objects
       // Split by lines that start with '{' at the beginning
       const jsonObjects = output.split(/\n(?=\{)/).filter(chunk => chunk.trim());