Support OASIS Static Analysis Results Interchange Format (SARIF) Output

[bryantschuck]

@jossef @cx-monicac the idea here is to support this output to make it easier to ingest by security tools, one of those is CxOne

[baruchiro]

If you support SARIF you can use it with #39 & #30.

https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning

[jossef]

please refer to
#40