Github action

[another-rex]

This PR features:

• Refactors the format flag's internal logic so that we can don't need to repeat the format types so much, and we can test when we add a new format entry if we forgot anything.
• Adds a new format "sarif", which returns a SARIF report (closes Add support for SARIF output #216 )
• Adds a Github Action action.yaml and it's specialized dockerfile action.dockerfile. This docker image runs a bash script wrapping osv-scanner, first by preprocessing the input so the last argument will be split by new line, allowing the workflow user to pass in multiple directories/files they wish to scan. The script also changes exit codes 127 and 128 to 0 as they contain errors that the user can't really do anything about.
• Adds a workflow using this new github action for this repo
• Sorts the grouped ID output.

Example of what workflow sarif output looks like:

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[another-rex]

• Added a test for the sarif output
• Removed markdowntext.go
• Refactored Sarif reporter so that most of the logic is in the internal output library

[oliverchang]

is the second arg still necessary if we're doing recursive scans?

[oliverchang]

Should we make this a reusable workflow to let users easily use this? https://github.blog/2022-02-10-using-reusable-workflows-github-actions/

Disclaimer: I haven't looked too deeply into this. There's also composite actions which is something different.