feature: make a CUE module (WIP)

[myitcv]

This work-in-progress PR builds on top of #138 (hence the "repetition" of the commits in this PR) to demonstrate the change required to publish this module to the CUE Central Registry.

The only change required was to make this repo a CUE module: that's it!

As a demonstration of what's possible once published as a module, I published the code to a "scratch" namespace. Now you can do something like:

cue vet -d '#SecurityInsights' github.com/cue-tmp/scratch/security-insights-spec@v0.0.0:security_insights_spec my-file.yml

[myitcv]

Incidentally, the "stutter" of github.com/cue-tmp/scratch/security-insights-spec@v0.0.0:security_insights_spec occurs because the last element of the import path security-insights-spec does not match the package identifier security_insights_spec. CUE package identifiers cannot contain - so that would require a rename of this repository, or moving the spec to a subdirectory. But if, say, we did rename the repo to security_insights_spec the the command would read more cleanly as:

cue vet -d '#SecurityInsights' github.com/cue-tmp/scratch/security_insights_spec@v0.0.0 my-file.yml

[eddie-knight]

Thanks for doing this @myitcv !

@jmeridth @GeauxJD What do yall think about adjusting the repo name? GitHub handles redirects, but would we have any other technical or social consequences?

[myitcv]

Just to flag, the alternative is to move the schema package one directory level deeper, e.g.

module: "github.com/ossf/security-insights-spec/insights"

But that raises the question of "what name shall we have in the last path element?"

[trumant]

Suggested change

	module: "github.com/ossf/security-insights-spec"
	module: "github.com/ossf/security-insights"

[trumant]

Suggested change

	version: "v0.11.0"
	version: "v0.13.0"

[jmeridth]

@myitcv is this still WIP?