feat: add SARIF output format for policy violations #151

Job	Run time
Analyze (java-kotlin)	3m 30s
Analyze (python)	1m 20s
Analyze (c-cpp)	12m 33s
Analyze (csharp)	5m 10s
Analyze (javascript-typescript)	4m 25s
Analyze (go)	4m 42s
Analyze (rust)	7m 44s
	39m 24s

Provide feedback