feat(sarif): add invocation startTimeUtc and endTimeUtc to SARIF output

[ltianyi992]

Summary

Adds a SARIF invocations block to every run, containing:

Field	Value
startTimeUtc	When SarifWriter was initialised (approximates scan start)
endTimeUtc	When Write() returns (scan completion)
executionSuccessful	Always true (SARIF is only produced on success)

Example output:

"invocations": [
  {
    "startTimeUtc": "2026-03-26T20:53:52.123456789Z",
    "endTimeUtc":   "2026-03-26T20:53:53.063429591Z",
    "executionSuccessful": true
  }
]

Motivation

Closes #3226

Consumers of SARIF output often need to verify scan freshness. Without invocations, there is no timestamp inside the SARIF file itself. This change lets monitoring tools (dashboards, CI gates, compliance pipelines) check the report age without relying on filesystem metadata or external systems.

Changes

• pkg/report/sarif.go — added StartTime time.Time field to SarifWriter; Write() appends an invocation before adding the run to the report.
• pkg/report/writer.go — initialises StartTime to time.Now() when the SarifWriter is created for --format sarif.
• pkg/report/sarif_test.go — extended the test loop to assert one invocation exists per run with executionSuccessful=true and non-empty timestamps; invocations are stripped before the remaining struct equality check so no existing want entries need updating.

SARIF conformance

Both startTimeUtc and endTimeUtc are defined as optional in SARIF 2.1.0 §3.20.6–3.20.7 and use the RFC 3339 format required by the spec.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

james seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

james seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[DmitriyLewen]

Hello @ltianyi992
Please, read #10340 (review)