gemaraconv: SARIF results should carry the Gemara result status (and ideally kind + fingerprints)

[jmeridth]

gemaraconv/sarif.go maps Gemara statuses to SARIF purely via level (Failed → error, NeedsReview/Unknown → warning, Passed → note) and omits result.kind and partialFingerprints.

This causes problems for GitHub Code Scanning consumers (context: revanite-io/osps-baseline-action#17, mitigation on the action side in revanite-io/osps-baseline-action#54):

1. GitHub opens an alert for every uploaded result regardless of level, so NeedsReview and even Passed results become permanently open alerts that can never auto-close, since the evaluator re-emits them on every run by design.
2. Downstream tools that want to filter (e.g. upload only Failed results) must infer status from level, which conflates NeedsReview with Unknown and is fragile if the mapping ever changes.
3. Per SARIF 2.1.0, NeedsReview is semantically kind: "review" and Passed is kind: "pass"; with no kind set, every result defaults to kind: "fail", which asserts a confirmed problem.
4. Without partialFingerprints and with a synthetic artifact URI, alert matching degrades to ruleId + location, so a dismissed NeedsReview alert can mask a later genuine failure of the same control.

Proposal: emit the Gemara status in result.properties (e.g. "gemara/result": "NeedsReview"), set result.kind per the spec, and consider a converter option like WithExcludedStatuses(...) so callers can drop statuses at generation time. Happy to send a PR if the direction sounds right.

@jpower432 @eddie-knight would appreciate your feedback on the direction here.

[eddie-knight]

I think this all makes sense. My original understanding was that we needed to post the passing/note message to overwrite failures, but that may have been a misunderstanding on my part. Happy to help push through any fix that improves the SARIF output.

[jpower432]

I agree. The suggested approach seems reasonable to me. Wondering if we should try to (optionally) incorporate the new Evidence Model for real artifact URIs. We could fall back to synthetic. Doesn't need to be on this PR if is expands scope though.