M5.4: Implement SARIF 2.1.0 report renderer

[bjcorder]

Labels: type:feature, area:report, priority:critical,
status:blocked, milestone:M5, phase:9

Summary

Render scan results as SARIF 2.1.0 for consumption by GitHub code
scanning, Sonar, and other security dashboards.

Acceptance criteria

• internal/report/sarif.go exposes:
  • func RenderSARIF(scan Scan, findings []Finding) ([]byte, error)
• Output is schema-valid SARIF 2.1.0
• Each VULNERABLE finding becomes a result with:
  • level: "error"
  • ruleId: <advisory_id>
  • message.text: the advisory summary
  • locations[].physicalLocation.artifactLocation.uri: the fork's
    HEAD commit URI
• Tool metadata identifies ForkGuard with its version
• Tests validate the output against the SARIF 2.1.0 schema

Implementation notes

The SARIF spec lives at:
https://docs.oasis-open.org/sarif/sarif/v2.1.0/

Use a published SARIF schema for validation in tests:
https://json.schemastore.org/sarif-2.1.0.json

Dependencies

Depends on: #20

---