Vulnerability Detection with Code Language Models: How Far Are We?