SARIF output uses non-existent 'SRCROOT' for results locations

[f1ames]

The SARIF output results array produced by validation package uses SRCROOT for each result location like:

{
    "ruleId": "KSV001",
    "rule": {...},
    "taxa": [...],
    "level": "warning",
    "message": {
        "text": "Disallow the process from elevating its privileges on container \"panda-blog\"."
    },
    "locations": [
        {
            "physicalLocation": {
                "artifactLocation": {
                    "uriBaseId": "SRCROOT",
                    "uri": "path/to/file.yaml"
                },
                "region": {
                    "startLine": 22,
                    "startColumn": 11,
                    "endLine": 27,
                    "endColumn": 1
                }
            }
        },
        {
            "physicalLocation": {...},
            "logicalLocations": [...]
        }
    ]
}

However, SRCROOT is not defined anywhere. And according to specs it either should not be there (if uri is absolute path) or should be defined:

If this artifactLocation object describes a top-level artifact and the value of its uri property (§3.4.3) is a relative reference, the artifactLocation object SHOULD contain a property named uriBaseId whose value is a string which indirectly specifies the absolute URI with respect to which that relative reference is interpreted. If the uri property contains an absolute URI, the uriBaseId property SHALL be absent. If this artifactLocation object describes a nested artifact, uriBaseId SHALL be absent.

It still works with e.g. SARIF Viewer VSC extension most probablybecause specs gives some flexibility here

3. If uriBaseId is not yet resolved, the consumer MAY use other information or heuristics to locate the artifact.

This can be solved e.g. be defining global SRCROOT in originalUriBaseIds as described in specs here - https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Ref508869459 (at the end of this section is also resolution procedure described).

Related to kubeshop/vscode-monokle#12.