internal/scan: add isImported function

This change adds an "isImported" function, which will return false if a
vuln is only exposed through a module required at a module level and
not from a package/symbol imported or called at a package level.

Change-Id: I7c0477fd4c96ea6f360c414daf9dcbd8492519db
Reviewed-on: https://go-review.googlesource.com/c/vuln/+/525756
Run-TryBot: Maceo Thompson <maceothompson@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Zvonimir Pavlinovic <zpavlinovic@google.com>

internal/scan/template.go

diff --git a/internal/scan/template.go b/internal/scan/template.go
index 953fbae..afb7b65 100644
--- a/internal/scan/template.go
+++ b/internal/scan/template.go
@@ -97,6 +97,15 @@
 	return result
 }
 
+func isImported(findings []*findingSummary) bool {
+	for _, f := range findings {
+		if f.Trace[0].Package != "" {
+			return true
+		}
+	}
+	return false
+}
+
 func isCalled(findings []*findingSummary) bool {
 	for _, f := range findings {
 		if f.Trace[0].Function != "" {