gopls/internal/vulncheck: log progress

Log before/after package loading and govulncheck.Source calls.
All stderr output of `gopls vulncheck` command is forwarded to the
client as LSP progress reports and visible to users.

go/packages.Load can be traced further if GOPACKAGESDEBUG env var
is set. Instrumentation in govulncheck.Source is still under
discussion in upstream.

For golang/go#56795

Change-Id: I8244930494aed17b319887bf96c2523f3215fa50
Reviewed-on: https://go-review.googlesource.com/c/tools/+/452055
Run-TryBot: Hyang-Ah Hana Kim <hyangah@gmail.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Suzy Mueller <suzmue@golang.org>
gopls-CI: kokoro <noreply+kokoro@google.com>

gopls/internal/vulncheck/command.go

@@ -222,11 +222,14 @@ func init() {
 		cfg.Mode = packages.NeedName | packages.NeedImports | packages.NeedTypes |
 			packages.NeedSyntax | packages.NeedTypesInfo | packages.NeedDeps |
 			packages.NeedModule
-
+		logf := log.New(os.Stderr, "", log.Ltime).Printf
+		logf("Loading packages...")
 		pkgs, err := packages.Load(&cfg, patterns...)
 		if err != nil {
+			logf("Failed to load packages: %v", err)
 			return err
 		}
+		logf("Loaded %d packages and their dependencies", len(pkgs))
 		cli, err := client.NewClient(findGOVULNDB(&cfg), client.Options{
 			HTTPCache: gvc.DefaultCache(),
 		})
@@ -240,6 +243,7 @@ func init() {
 		if err != nil {
 			return err
 		}
+		logf("Found %d vulnerabilities", len(res.Vulns))
 		if err := json.NewEncoder(os.Stdout).Encode(res); err != nil {
 			return err
 		}