Refactor DGP off Sarif4k

[cortinico]

Is the remaining action that we should refactor DGP off Sarif4k so that

• Respecting KGP compileOnly dependency
• Not exposing transitive dependency when our client/users depends on KGP

Originally posted by @chao2zhang in detekt/sarif4k#43 (comment)

[chao2zhang]

There are two ways I can think of

• Depend on simplejson to do lightweight parsing and merging
• Because gradle bundles with GSON or Jackson, we can define the object mapping for Sarif in Gson or Jackson.

[cortinico]

Because gradle bundles with GSON or Jackson, we can define the object mapping for Sarif in Gson or Jackson.

I would prefer this one as it won't bring any extra dependency

[TWiStErRob]

Would package relocation be an option that might be simpler to achieve without a rewrite of I/O in Detekt?

[cortinico]

Yup that's also an option. Still we use just one method of Sarif4k in DGP, so refactoring might be preferred

[TWiStErRob]

I was curious how it would look like, so I raised #6117.