feat: import sarif security evidence

[duriantaco]

Summary

• import SARIF 2.1.0 logs as security_check evidence
• require exact compiled obligation IDs in SARIF rule IDs or properties/tags
• route high/critical mapped SARIF findings through the existing blocking finding and policy path
• infer security obligations from SARIF in manifest attach-artifact

Validation

• go test ./internal/vouch -run 'TestSARIF|TestAttachArtifactInfersSARIF|TestVerifierOutputFindingBlocksReleasePolicy'
• go test ./...