feat(export): add SARIF 2.1.0 export format for GitHub Code Scanning

Add --format sarif to the export command, producing SARIF 2.1.0 compliant output that can be uploaded to GitHub Code Scanning via github/codeql-action/upload-sarif@v4.

Closes #40

What

• New buildSarifLog() and writeSarif() in export.ts
• Severity mapping: CRITICAL/HIGH → error, HIGH_BUG/MEDIUM → warning, BUG/LOW → note
• vulnSlug → SARIF ruleId; rules deduped per run
• Each project → one SARIF run
• Custom properties preserve original severity, confidence, revalidation verdict
• Stable partialFingerprints.primaryLocationLineHash for cross-run tracking

Why

Enables deepsec findings to be displayed as PR annotations and in the repository Security tab, integrating with GitHub's native code scanning workflow.

Testing

• 18 unit tests in export-sarif.test.ts covering structure, severity mapping, rule dedup, locations, fingerprints, properties, multi-project
• E2E test in pipeline.test.ts validates the full pipeline produces valid SARIF
• Validated against official SARIF 2.1.0 JSON schema (ajv)
• Validated end-to-end: SARIF uploaded to GitHub Code Scanning via upload-sarif@v4 action, all 10 findings accepted successfully

What changed

Why

Verification

• pnpm test passes
• pnpm lint passes
• pnpm knip passes
• If this adds a matcher: ran it against at least one real repo and confirmed the candidate count is sane

Notes for reviewer