SARIF files are missing detailed finding information

[fcasal]

The SARIF files generated by zizmor are missing information present when the tool is run using the stdout:

• The code span in the SARIF file does not span the vulnerable regions (at least for the template-injection rule):

error[template-injection]: code injection via template expansion
  --> .github/workflows/hazmat.yml:50:9
   |
50 |         - name: vulnerable-2
   |           ^^^^^^^^^^^^^^^^^^ this step
51 |           # NOT OK: attacker controlled workflow_dispatch input
52 |           run: |
   |  _________^
53 | |           echo "doing a thing: ${{ inputs.hackme }}"
   | |____________________________________________________^ inputs.hackme may expand into attacker-controllable code

only spans line 50 on the sarif file:

              "physicalLocation": {
                "artifactLocation": {
                  "uri": "hazmat.yml",
                  "uriBaseId": "%workflows%"
                },
                "region": {
                  "endColumn": 27,
                  "endLine": 50,
                  "snippet": {
                    "text": "name: vulnerable-2"
                  },
                  "sourceLanguage": "yaml",
                  "startColumn": 9,
                  "startLine": 50
                }
              }

• Severity information is present on the cli but not on the SARIF file: the CLI distinguishes several cases for the same rule, while the SARIF file has no information about this. I believe this is usually encoded using the level property https://docs.oasis-open.org/sarif/sarif/v2.1.0/csprd01/sarif-v2.1.0-csprd01.html#:~:text=notification.message.-,3.58.6%20level%20property,-A%20notification%20object

[woodruffw]

• Severity information is present on the cli but not on the SARIF file: the CLI distinguishes several cases for the same rule, while the SARIF file has no information about this. I believe this is usually encoded using the level property docs.oasis-open.org/sarif/sarif/v2.1.0/csprd01/sarif-v2.1.0-csprd01.html#:~:text=notification.message.-,3.58.6 level property,-A notification object

Began on this with #68, although it's currently blocked by psastras/sarif-rs#738.