Ingest vulnerabilities for community packages from Alpine #6223

Is your feature request related to a problem? Please describe.
OSV.dev currently only ingests vulnerabilities for the Alpine Linux main repo and ignores the community repo, which is also supported and packaged in part by the Alpine Linux maintainers. This repo contains a fairly significant set of packages (chromium, firefox, go, etc.).

Describe the solution you'd like
Ingest the community.json file in addition to the main.json file from Alpine secdb (e.g. https://secdb.alpinelinux.org/v3.20/).

Describe alternatives you've considered
None.

Additional context
vulnfeeds/cmd/converters/alpine/main.go hardcodes alpineURLBase = "https://secdb.alpinelinux.org/%s/main.json", so only the main repository is converted. Every package in Alpine's community repository is missing from OSV.

Examples (POST /v1/query, ecosystem Alpine:v3.20): go, containerd, chromium, clamav, composer all return {}, even though each has secfixes entries in https://secdb.alpinelinux.org/v3.20/community.json. curl (main) returns 121 vulns.

Scale: across v3.3–v3.24, community.json has 64,485 secfixes CVE references vs 44,935 in main.json. Package names never overlap between the two files in any release, so both can map to the same Alpine:<release> ecosystem and pkg:apk/alpine/<name> PURL.