Improve SARIF output

[bradlarsen]

SARIF support was recently added (#33, #4), adding a new output format to Nosey Parker's report command. This support is preliminary, but good enough that viewers like the VSCode SARIF plugin can do something useful with the output in some cases.

However, I want Nosey Parker to do something useful in all cases. The end goal is that Nosey Parker's SARIF output is complete enough that common viewers can usefully render all findings.

Viewers of particular interest:

• GitHub Code Analysis (so that SARIF output can be automatically shown in pull requests)
• VSCode SARIF Viewer
• The sarif-fmt command-line program

Rough edges and opportunities for improvement:

1. Findings in blobs from Git repositories don't have useful location information associated with them.
2. Nosey Parker rules don't have a stable and machine-friendly ID associated with them, just a name.
3. Nosey Parker rules don't have a long description, severity, or precision associated with them.
4. Currently, the VSCode SARIF Viewer's functionality to annotate findings as false positives crashes with Nosey Parker-generated output, probably due to some missing field.
5. The location info in SARIF results is for the entire regex match rather than just the match group.

[bradlarsen]

See this for requirements and suggestions related to GitHub Code Analysis SARIF support: https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning

[bradlarsen]

I asked for help in understanding how best to represent Nosey Parker's findings in SARIF: oasis-tcs/sarif-spec#564