requirements.txt transitive traversal could potentially leak other files on the same image in CI

[another-rex]

When running in CI, a malicious actor could open a PR with a requirements.txt file that links to other secret files that are formatted like requirements.txt (and match valid versions, so quite niche), and force osv-scanner to print out the contents (e.g. as a vulnerability report).

We should prevent this in two ways:

1. Defaulting to not setting ScanRoot to / (This is a breaking change)
2. Adding an extra flag to allow users to manually set the scan root.

Lodging this as a task for V3.

See google/osv-scalibr#2323 for context.