SARIF1015 mishandles run.originalUriBaseIds (@kupsch)

[harleenkohli]

Original text:
The SARIF validator (https://sarifweb.azurewebsites.net/Validation) gives a "SARIF1015: Certain URIs are required to be absolute" on PACKAGEROOT from the SARIF fragment below. I believe this should be allowed. The Sarif.Multitool validator (which I'm guessing the web site is based on) produces the same error.

The check could simply be a uri needs to be absolute if there is not a uriBaseId.

  "originalUriBaseIds": {
     "RESULTSROOT": {
       "uri": "file:///home/kupsch/results/"
     },
     "PACKAGEROOT": {
       "uri": "pkg1/",
       "uriBaseId": "BUILDROOT"
     },
     "BUILDROOT": {
       "uri": "file:///home/kupsch/build/"
     }
   },

Also the web page requires the use of the .sarif extension and does not allow files with the .sarif.json extension.

[ghost]

It is legal to have a relative URI even in uriBaseId is missing. The check needs to be specific to this situation: within originalUriBaseIds, the top-level URI needs to be absolute and all others need to be relative.

[ghost]

We will add a new rule specific to originalUriBaseIds, and remove the originalUriBaseIds check from SARIF1015.