Support for vdb download from huggingface

vdb6 is getting uploaded to [HuggingFace](https://huggingface.co/datasets/AppThreat/vdb) via this [workflow](https://github.com/AppThreat/vdb/blob/main/.github/workflows/build-vdb6.yml).

The library could offer an option to use the [huggingface_hub](https://pypi.org/project/huggingface-hub/) library instead of oras for download.