vulncheck: release pointers to types.Package

PkgNode.pkg holds a pointer to vulncheck.Packages, which holds a pointer
to types.Package. In practice, the lifetime of these objects are
similar, but it is cheap and sound to remove PkgNode.pkg pointer.

Change-Id: I88d94c7ffa8b87fe2bb55db762107d4e6f9b0e59
Reviewed-on: https://go-review.googlesource.com/c/vuln/+/441895
Run-TryBot: Zvonimir Pavlinovic <zpavlinovic@google.com>
Reviewed-by: Jonathan Amsterdam <jba@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
diff --git a/vulncheck/source.go b/vulncheck/source.go
index d24639b..be3a5df 100644
--- a/vulncheck/source.go
+++ b/vulncheck/source.go
@@ -79,6 +79,12 @@
 	entries := entryPoints(ssaPkgs)
 	cg := callGraph(prog, entries)
 	vulnCallGraphSlice(entries, modVulns, cg, result)
+
+	// Release residual memory.
+	for _, p := range result.Imports.Packages {
+		p.pkg = nil
+	}
+
 	return result, nil
 }