fix: improve SARIF exports for GitHub

[ianw-oai]

Summary

GitHub can import the existing SARIF export, but raw rule names and missing rule help make alerts difficult to act on. Add readable rule names, fix guidance, security severity, and CWE tags from the canonical findings.

Changes

• Add rule help and finding-specific fix and test guidance.
• Use canonical severity scores when present. Use documented display values otherwise. A shared rule uses its highest finding score.
• Preserve rule IDs, finding IDs, fingerprints, source locations, and the sealed JSON files.
• Add regression tests for shared rules, severity mapping, stable identity, and sealed exports.

Testing

• Focused SARIF and export tests: 29 passed.
• pnpm run test --seed 12345: 1,436 passed, 23 skipped, zero failures.
• pnpm run test: 1,436 passed, 23 skipped, zero failures.
• pnpm run types and pnpm run format: passed.
• pnpm pack and node scripts/check-package.mjs <tarball>: passed, including the installed-package checks.

Risk and rollout

This changes SARIF presentation only. GitHub reads security severity from the shared rule, so each alert also retains its own severity and fix guidance. The canonical scan format and release versions do not change. No live GitHub code-scanning upload was run.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.