Update OSS Index datasource for Sonatype Guide

[GHX5T-SOL]

Closes #2311.

Summary:

• Point the OSS Index datasource at Sonatype Guide compatibility API endpoints.
• Keep the existing OSS Index-compatible request/response parsing behavior.
• Add focused no-network tests for unauthenticated and authenticated endpoint selection.

Validation:

• .venv/bin/python -m pytest vulntotal/tests/test_oss_index.py -q (3 passed; local Python 3.14 required pytest 9.0.3 because repo-pinned pytest 7.1.1 errors before collection on Python 3.14)
• .venv/bin/python -m black --check vulntotal/datasources/oss_index.py vulntotal/tests/test_oss_index.py
• .venv/bin/python -m isort --check-only vulntotal/datasources/oss_index.py vulntotal/tests/test_oss_index.py
• git diff --check
• git diff --cached --check
• git diff --no-ext-diff | gitleaks stdin --no-banner --redact --exit-code 1
• git diff --cached --no-ext-diff | gitleaks stdin --no-banner --redact --exit-code 1

Limitations:

• Full make test was not run locally; this was validated with a minimal focused virtualenv on Python 3.14.