feat(audit): add SARIF 2.1.0 output for the report mode (#488)

[ChrisJr404]

Closes #488.

GitHub code scanning, GitLab Vulnerabilities, Sonar, Azure DevOps and several other consumers ingest SARIF 2.1.0 to display security findings in their UIs. Today detect-secrets users have to write a glue script to convert `detect-secrets audit --report` JSON into SARIF before feeding it to those systems — this adds a native `--sarif` switch.

@lorenzodb1 mentioned in #488 that the team had a hard time finding an easy conversion path; the implementation here doesn't pull in any new dependencies (no `microsoft/sarif-python-om`, no jsonschema runtime), it just emits the SARIF 2.1.0 dict directly, validated against the schema URL embedded in the document.

Usage

```bash
detect-secrets audit --report --sarif .secrets.baseline > findings.sarif
```

`--only-real` / `--only-false` work the same way as on the existing JSON report.

Mapping

SARIF field	Source
`ruleId`	detect-secrets plugin name (`Type`)
`message.text`	"`Potential secret detected by : `"
`kind`	`"open"` for true positives, `"review"` for false-positives (SARIF §3.27.9)
`level`	`"error"`
`locations[0].physicalLocation`	`artifactLocation.uri`, `region.startLine`, `region.snippet.text`
`partialFingerprints["detectSecretsHash/v1"]`	`::` (stable across runs, doesn't expose the secret)
`properties.category`	original `VerifiedResult` name
Tool driver	`name=detect-secrets`, `version=version.VERSION`, `informationUri`=GitHub repo

Implementation

• `detect_secrets/audit/sarif.py` — new module. Thin layer over `audit.report.generate_report` so the SARIF view stays consistent with what users already see in JSON.
• `detect_secrets/core/usage/audit.py` — adds `--sarif` flag.
• `detect_secrets/main.py::handle_audit_action` — branches on `args.sarif` when in `--report` mode.
• `detect_secrets/audit/init.py` — exposes `audit.sarif`.

Tests

`tests/audit/sarif_test.py`:

• `test_envelope_structure` — every `ruleId` references an existing rule by index, `$schema`, `version`, driver fields are correct.
• `test_results_contain_findings` — every result has at least one location with `uri` + `startLine` + `snippet` + a stable `partialFingerprints` entry.
• `test_only_real_filter` / `test_only_false_filter` — filter flags carry through.
• `test_kind_field_reflects_classification` — `kind: "open"` for true positives, `"review"` for false-positives, per spec.

Test results

`tests/audit/` + `tests/main_test.py`: 53 passed.

```
tests/audit/sarif_test.py::test_envelope_structure PASSED
tests/audit/sarif_test.py::test_results_contain_findings PASSED
tests/audit/sarif_test.py::test_only_real_filter PASSED
tests/audit/sarif_test.py::test_only_false_filter PASSED
tests/audit/sarif_test.py::test_kind_field_reflects_classification PASSED
```

Failures elsewhere in the suite (`tests/filters/{gibberish,wordlist}`, `tests/plugins/base_test::test_handle_verify_exception_gracefully`, `tests/pre_commit_hook_test::test_quit_if_baseline_is_changed_but_not_staged`) pre-date this PR and are unrelated to the audit module.

Live-verify

Scanned a fixture file with an AWS access key + GitHub PAT and generated a baseline:

```json
{
"$schema": "https://docs.oasis-open.org/sarif/sarif/v2.1.0/cos02/schemas/sarif-schema-2.1.0.json\",
"version": "2.1.0",
"runs": [
{
"tool": {"driver": {"name": "detect-secrets", "version": "1.5.0", ...}},
"results": [
{
"kind": "open",
"level": "error",
"locations": [{"physicalLocation": {
"artifactLocation": {"uri": "config.py"},
"region": {"startLine": 1, "snippet": {"text": "AWS_ACCESS_KEY_ID = ..."}}
}}],
"message": {"text": "Potential secret detected by AWS Access Key: unverified."},
"partialFingerprints": {"detectSecretsHash/v1": "config.py:AWS Access Key:1"},
"properties": {"category": "UNVERIFIED"},
"ruleId": "AWS Access Key",
"ruleIndex": 0
},
...
]
}
]
}
```