Populates project with all existing code from common subpackage with the
following differences:

- Rename package `issue` to `vulnerability`
- Rely on `analyzers/ruleset` over `common/v2/ruleset`
- Simplify `TestDisableIdentifierReports` spec to rely on fewer fixtures
- Add README, CHANGELOG, LICENSE, and CONTRIBUTING