SARIF format for publishing scan findings

[mitchspano]

SARIF is an acronym for the Static Analysis Results Interchange Format, which is a standard, JSON-based format for the output of static analysis tools.

Instead of using the GitHub REST API to publish the findings as comments, we should use the SARIF format to standardize the way findings are reported.

Here is some documentation for usage of the SARIF format within GitHub.