cmd/vulnreport: fix adding of TODOs to packages

Fix a bug where were were modifying a copy of a value in a slice,
rather than the value itself.

Change-Id: Ie4bbc93c04d2e810a0051f8db1d802f31630f676
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/405576
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Julie Qiu <julieqiu@google.com>
Run-TryBot: Damien Neil <dneil@google.com>
Auto-Submit: Damien Neil <dneil@google.com>
diff --git a/cmd/vulnreport/main.go b/cmd/vulnreport/main.go
index aa1e1a9..6a183b1 100644
--- a/cmd/vulnreport/main.go
+++ b/cmd/vulnreport/main.go
@@ -170,7 +170,11 @@
 
 // addTODOs adds "TODO" comments to unfilled fields of r.
 func addTODOs(r *report.Report) {
-	for _, p := range r.Packages {
+	if len(r.Packages) == 0 {
+		r.Packages = append(r.Packages, report.Package{})
+	}
+	for i := range r.Packages {
+		p := &r.Packages[i]
 		if p.Module == "" && !stdlib.Contains(p.Module) {
 			p.Module = todo
 		}