osv: let open Json.Codec in cleanup
39 Json.Codec. prefixes removed. The raw_vuln record uses rv_*
prefixed field names that don't clash with Json.Codec.mem_map.
The unprefixed `vulnerability` record (with `id`) has no associated
codec body to disambiguate.