docs: document data sources and external services (#2457)

## Overview

**Issue:** https://github.com/google/osv-scanner/issues/1433

This PR adds a "Data Sources and Privacy" section to the README
documenting the external services OSV-Scanner communicates with during
operation.

Fixes #1433

## Details

Added documentation for:

- **OSV.dev API** (`/v1/querybatch`, `/v1/determineversion`) -
Vulnerability queries and vendored C/C++ detection
- **deps.dev API** - License scanning, dependency resolution, and
package deprecation
- **Package Registries** - Maven Central and npm Registry for native
resolution

The section also clarifies that `--offline` mode disables network
requests, and that no source code is transmitted.

## Testing

- [x] Manual review of README formatting and content
- [x] Verified documentation renders correctly

## Checklist

- [x] I have signed the [Contributor License
Agreement](https://cla.developers.google.com/).
- [x] I have run the linter using
[./scripts/run_lints.sh](cci:7://file:///Users/ankitsinghsisodya/osv-scanner/scripts/run_lints.sh:0:0-0:0).
(N/A - docs only)
- [x] I have run the unit tests using
[./scripts/run_tests.sh](cci:7://file:///Users/ankitsinghsisodya/osv-scanner/scripts/run_tests.sh:0:0-0:0).
(N/A - docs only)
- [x] I have made my commits and PR title follow the [Conventional
Commits](https://www.conventionalcommits.org/en/v1.0.0/) specification.

---------

Co-authored-by: Xueqin Cui <72771658+cuixq@users.noreply.github.com>