wip: Add SARIF output format

[swinton]

Adds support for the SARIF format to brakeman.

Some helpful information on the SARIF format is here.

[presidentbeef]

confidence is a conflation of both severity and confidence.

[swinton]

I added 9b95383 to infer severity from confidence.

[swinton]

For reference

Adding a screenshot of how SARIF properties are treated in the GitHub Code scanning alerts UI:

Note the following properties are pulled into the UI from this example SARIF file:

• id (source)
• shortDescription (source)
• fullDescription (source)
• tag (source)
• message (source)

Notes

• shortDescription and fullDescription are currently identical, and are both derived from the Check classes -- @presidentbeef are you still able to work on producing descriptions at the warning level?
• I'm trying to find out if we can render anything in the "rule help" section (where currently No rule help available for this alert is shown), and also whether Markdown is supported, so we can render links, such as helpUri

[presidentbeef]

shortDescription and fullDescription are currently identical, and are both derived from the Check classes -- @presidentbeef are you still able to work on producing descriptions at the warning level?

Yes, I can do this.

I'm trying to find out if we can render anything in the "rule help" section (where currently No rule help available for this alert is shown), and also whether Markdown is supported, so we can render links, such as helpUri

Another thought is to directly pull in some docs. I believe Code Climate does/did this using what is in https://github.com/presidentbeef/brakeman/tree/main/docs/warning_types (in fact, that directory is just for them). However those docs are not currently up-to-date... but they can be updated. The content is from the Brakeman site which is licensed under Creative Commons.

[swinton]

Another thought is to directly pull in some docs

Great idea 👍 SARIF supports Markdown-formatted messages, I will see if there's a way to render these in the UI.

[swinton]

I opened a new PR targeting brakeman:main, closing this one.