Add SARIF export for secret scanning

[lleonardo-franco]

Summary

• export TealSecrets findings as GitHub Code Scanning-compatible SARIF with stable detector rule IDs, detector metadata, file regions, and partial fingerprints
• add tealtiger scan <file-or-directory> --format sarif --output results.sarif and ensure the published CLI bundle contains its scan dependencies
• document SARIF scanning, add an Actions upload example, and cover exporter and CLI behavior with tests

Validation

• npx tsc --noEmit
• npm run build:types
• npm test -- --runInBand --no-watchman (95 suites, 2368 tests)
• node dist/cli/test.js scan src/cli/__tests__/scan.test.ts --format sarif --output /private/tmp/tealtiger-122-results.sarif

Resolves agentguard-ai/tealtiger#122