feat: add SARIF 2.1.0 output (-f sarif)

[ChrisJr404]

Adds -f sarif to openant report. Emits a SARIF 2.1.0 log so a scan can be uploaded to GitHub Code Scanning or GitLab SAST without writing a converter, which is the format every other SAST in this category supports.

Implementation mirrors -f html: Python's report-data returns the same pre-computed JSON we already use for HTML, and the SARIF emitter is purely Go-side (no LLM round-trip, deterministic). Findings become SARIF results, verdicts get hoisted into a synthesized rules list. vulnerable and bypassable surface as level error, inconclusive and unclear as warning, everything else as note.

Couple of choices worth calling out:

• No startLine in the location region. The current Finding struct only carries file + function, so I omit the region rather than emit a synthetic line 1 (which would anchor alerts to the wrong row in Code Scanning). When line numbers eventually land in ReportData, the region payload in sarifLocationFor is the only thing that needs to grow.
• Each result carries a partialFingerprints entry keyed openant/file/function/verdict/v1, so successive scans dedupe cleanly in Code Scanning instead of opening fresh alerts each run.
• Rules are synthesized per verdict since findings aren't keyed by a stable per-rule taxonomy yet. Categories from ReportData.Categories supply the descriptions, falling back to a generic blurb if a verdict has no category entry.
• versionControlProvenance is emitted when ReportData.RepoURL is set, including revisionId from CommitSHA if available. Skipped entirely otherwise so we don't write a half-empty object.

Default output path is <resultsDir>/final-reports/report.sarif, matching the HTML default's directory layout.

15 unit tests in internal/report/sarif_test.go cover envelope shape, rule dedup, level mapping, path normalization (./ strip + backslash conversion), logical location, dynamic test property propagation, fingerprint stability, VCS provenance gating, the empty-AttackVector fallback that keeps message.text non-empty per spec, the 4 KiB message cap, and an end-to-end round-trip through json.Unmarshal to confirm the emitted log is valid JSON.

go test ./... is green; gofmt and go vet are clean.

Open to a different flag shape if you'd rather. Could be a flag on scan so it lands alongside pipeline_output.json automatically, or the rule synthesis can be split into something more granular if per-verdict rules feel too coarse for Code Scanning's per-rule severity controls.