✨ SARIF 3: add flag to yaml

[laurentsimon]

• Please check if the PR fulfills these requirements

• [] Tests for the changes have been added (for bug fixes / features)
• PR title follows the guidelines defined in https://github.com/ossf/scorecard/blob/main/CONTRIBUTING.md#pr-process

• What kind of change does this PR introduce? (Bug fix, feature, docs update, ...)
  feature

• What is the current behavior? (You can also link to an open issue here)
  no metadata

• What is the new behavior (if this is a feature change)?
  add tags so we can use them in SARIF. (tags are optional in SARIF)

• Does this PR introduce a breaking change? (What changes might users need to make in their application due to this PR?)
  no

• Other information:

[laurentsimon]

@naveensrinivasan getting

/bin/bash: protoc: command not found
make: *** [Makefile:93: cron/data/metadata.pb.go] Error 127

[naveensrinivasan]

@naveensrinivasan getting

/bin/bash: protoc: command not found
make: *** [Makefile:93: cron/data/metadata.pb.go] Error 127

Here is a much cleaner solution to solve this issue of generating proto files tektoncd/chains#192 which is also portable. I can take on this by reusing some of this code.