Specify location.message in SARIF reports

[candrews]

SARIF allows a "message" to be provided for a location and that can have more useful information. See:
https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317675

It would be helpful to set this property so SARIF consumers can display better information. It would be particularly nice if Trivy includes the file and the package name and version (ex, pom.xml:org.yaml:snakeyaml@1.30).

[xomgc3]

I'd like to piggy-back onto this issue, @candrews. The file path needs to be added to the message. When scanning multiple files of the same type, this is insufficient:

"message": {
  "text": "Dockerfile"
}

This is the command:

trivy config  --format sarif --exit-code  1 --severity  CRITICAL,HIGH --output  trivy-results.sarif ./my/nested/dir