Ingest guarddog findings into github's codeql/sarif ability

[legoktm]

Follow-up to freedomofpress/securedrop-client#3490; guarddog support sarif output, we should be able to ingest this into GitHub's codeql system. Need to see how it would work in practice

[ChumOfChance]

GuardDog has an --output-format sarif and I remember getting it to work with scans of python requirements.txt files, putting the results nicely into codeql. I did not get far enough to make it work with the approach I was using to scan pnpm managed dependencies, but with the approach in freedomofpress/securedrop-client#3490 it might be doable!

[ChumOfChance]

Returning to this now that I have refreshed my memory a bit. GuardDog only produces sarif output when run in verify mode, as opposed to scan. verify is for scanning a requirements.txt or package.json file (for pypi or npm-managed projects respectively). Using pnpm our package.json does not specify specific versions of dependencies we would want scanned (this is in pnpm-lock.yaml).

The trick would be taking an approach like in freedomofpress/securedrop-client#3490 and instead of generating a matrix of dependencies and then spawning a GuardDog scan run for each one, take the matrix and generate a packge-lock.json with each version and feed that to a single GuardDog verify run with sarif output.

[legoktm]

Should be straightforward to have an LLM write a script that can transform our pnpm-lock.yaml -> package-lock.json. We can also file an upstream issue asking for pnpm support...