refactor: use XDG_CACHE_HOME for default cache directory

[rilnicki]

Update the tool to determine the default cache directory using the XDG_CACHE_HOME environment variable, falling back to ~/.cache if unset. This brings the tool in line with the XDG Base Directory Specification.

Move cache-related default values into a new
database_defaults.py module to centralize configuration and improve code maintainability.

These changes improve compatibility with diverse environments and promote cleaner filesystem usage.

[rilnicki]

@terriko what do you think?

[terriko]

This looks promising!

I've approved the tests to run, but they'll likely fail because we've got a broken cache in our CI system at the moment. While we're working on getting that fixed, some thoughts:

• We should have a test to make sure this works
• You're going to want to update the documentation where we mention the cache (I think we do in a few places)
• I'm not sure this is going to handle the case where XDG_CACHE_HOME isn't set, so we might need to have it do a default there
• We may need to be careful about how it works on Windows (path stuff is always tricky there)

[rilnicki]

@terriko I rebased my branch on main and added tests for database_defaults.py which include testing the cache directory behaviour. When XDG_CACHE_HOME is not set then the default path is used ~/.cache. I also updated the MANUAL.md with Cache Directory Behavior section where it is clearly (I hope so!) explained.

[terriko]

Thanks! I'll get the tests running again. Our cache issue is resolved so if they don't all pass this time, do take a look to see if you need to fix something.

[rilnicki]

@terriko I forgot to run linters locally on a test file - my bad. I also fixed the tests so they will work on Windows properly. I noticed that:

• spell checking job complains about XDG word
• test_source_osv.py::TestSourceOSV::test_update_ecosystems() failed and it looks like expected_ecosystems downloaded from https://osv-vulnerabilities.storage.googleapis.com/ecosystems.txt are not the same as self.osv.ecosystems

Shall I do anything about these?