Evaluate and enable cherrypick detection for cve-osv

[oliverchang]

Currently, for our cve-osv source, detect_cherrypicks is off. This means that when we enumerate affected git commits, we are only considering the branches that contain the referenced fix commits.

This occasionally lead to missed matches.

We should evaluate turning on cherrypick detection for cve-osv. This has some implications:

• This will slow down record processing time.
• Cherrypick detection is not perfect, which can lead to false positives if we don't correctly identify all cherrypicked fixes.

Related issues:
#2576 (comment)
#1910 (comment)

[github-actions]

✨ Thank you for your interest in OSV.dev's data quality! ✨

Please review our FAQ entry on how to most efficiently have this addressed.

[github-actions]

This issue has not had any activity for 60 days and will be automatically closed in two weeks

See https://github.com/google/osv.dev/blob/master/CONTRIBUTING.md for how to contribute a PR if you're interested in helping out.