Add Root as official data source with ROOT-OS and ROOT-APP prefixes

[chait-slim]

Root provides security advisories for container images with patched vulnerabilities across multiple ecosystems including Alpine, Debian, Ubuntu, npm, PyPI, and Go modules.

This PR reserves two database-specific prefixes:

• ROOT-OS-: For OS-level package vulnerabilities (Alpine, Debian, Ubuntu, etc.)
• ROOT-APP-: For application-level package vulnerabilities (npm, PyPI, Go, etc.)

Root uses existing ecosystems and does not introduce a new ecosystem.

Changes:

• Add Root to README.md data sources list
• Add ROOT-OS and ROOT-APP prefix entries to docs/schema.md
• Update validation/schema.json prefix pattern to include ROOT-OS and ROOT-APP

osv.dev issue
osv.dev PR

[another-rex]

Thanks for the PR! Please update the ecosystems.json file and run ./scripts/update-ecosystem-lists.py to generate the required changes.

[another-rex]

This should be linking to a human readable documentation or webpage.

[chait-slim]

Can you elaborate on this please? Looking at other entries here like: MinimOS, Chainguard and Echo, it looks like they have the same type of link, but I might be missing the intention here

[another-rex]

It's not a strict requirement, but most links here links to a readme or intro of some kind that's more human friendly so that if folks are interested in a project, they can click on the link and see what they are and how they are publishing OSVs. If you folks do not have this kind of page, feel free to leave it as is.

[chait-slim]

Thanks for the PR! Please update the ecosystems.json file and run ./scripts/update-ecosystem-lists.py to generate the required changes.

Thanks! updated

[another-rex]

Thanks for the clarification, LGTM.

[another-rex]

It's not a strict requirement, but most links here links to a readme or intro of some kind that's more human friendly so that if folks are interested in a project, they can click on the link and see what they are and how they are publishing OSVs. If you folks do not have this kind of page, feel free to leave it as is.

[another-rex]

Can you have a look at the DCO check and resolve that, plus the merge conflicts? Thanks!