feat: Implement standardized SARIF telemetry generation for external platform compliance (#107)

[prasiddhi-105]

Before opening: make sure there is an issue tracking this work, and link it below. PRs without a linked issue may be closed without review.

Linked issue

Closes #107

What this PR does

This PR implements a standardized SARIF translation pipeline that processes internal vulnerability metrics into an enterprise-compliant format. It also introduces a dedicated export controller endpoint to dynamically serve the telemetry payload to external clients as a downloadable file attachment. This ensures seamless interoperability with third-party application security compliance dashboards like GitHub Advanced Security and SonarQube.

Type of change

• Bug fix
• New feature
• ML model / training pipeline
• Refactor (no behaviour change)
• Documentation
• Tests only

ML tier (if applicable)

• Tier 1 — Triage
• Tier 2 — Predictive
• Tier 3 — Autonomous
• Not ML-related

Stack affected

• Backend
• Frontend
• Both

---

Changes

Backend

• Added SarifTranslator class: Ingests standard JSON triage array elements, handles schema-compliant mappings (rule IDs, locations, line/column tracking), and normalizes tool severities to official lowercase SARIF compliance levels (error, warning, note).
• Added Export Controller Endpoint: Exposed a FastAPI GET endpoint at /api/export/sarif that executes the parsing pipeline on compilation metrics and streams the output directly as a .sarif file attachment.

---

Testing

How did you test this?

Verified the pipeline end-to-end using a local validation execution sequence. Tested with mock Semgrep raw JSON logs to ensure the keys mapped flawlessly into the target layout spec (https://json.schemastore.org/sarif-2.1.0.json) and verified the FastAPI route triggers a proper browser file download.

Checklist

• Tested locally end-to-end (upload ZIP or GitHub URL → scan → findings returned correctly)
• New ML model falls back gracefully when model file is absent
• No new console.error or unhandled Python exceptions introduced
• Added or updated tests where applicable
• requirements.txt / package.json updated if new dependencies added
• New model files (.pkl, .pt, etc.) are gitignored, not committed

---

Anything reviewers should focus on

Reviewers can verify that the severity mapping handling logic cleanly downcases tool levels into valid SARIF levels without throwing key errors on unexpected inputs.

[prasiddhi-105]

hii would love to work under your projects and contribute under your guidance, please assign me!!

[ionfwsrijan]

@prasiddhi-105 Please fix failing checks

[prasiddhi-105]

@ionfwsrijan yes, I'll do it by today itself

[ionfwsrijan]

@prasiddhi-105 Failing checks