x/vuln: improve vulnerability checking when PCLN table is not available but buildinfo is

[julieqiu]

From https://github.com/golang/vuln/blob/9268f8338db8b8377d58c92d7168aa495cc5b9c6/internal/vulncheck/internal/buildinfo/additions_scan.go#L76-L77:

If we have build information, but not PCLN table, we should be able to fall back to much higher granularity vulnerability checking

[gopherbot]

Change https://go.dev/cl/560375 mentions this issue: internal/buildinfo: do module-level analysis with no PCLN table