feat: add SARIF scan reporter

[cjc0013]

Summary

• add a SARIF 2.1.0 reporter for failed Crucible findings
• wire scan output through --format sarif and .sarif output suffix detection
• include SARIF tests for headers, severity levels, OWASP metadata, file writing, and CLI output routing
• update the changelog

Fixes #34.

Validation

• python -m pytest -q - 276 passed
• python -m ruff check crucible tests
• python -m black --check crucible tests
• python -m mypy crucible tests
• git diff --check