feat(report): add level field to SARIF result output

[rasta-rocket]

Summary

Add the level field to the result entries in the SARIF report output, aligning with the SARIF 2.1.0 specification.

Motivation

The SARIF spec defines a level field on result objects that indicates the severity of the finding (error, warning, note, none). Previously, KICS only set level on the rule's defaultConfiguration but omitted it from individual results. Some SARIF consumers (IDE integrations, CI/CD tools, dashboards) rely on the result-level level field to filter or prioritize findings.

Changes

• pkg/report/model/sarif.go: Added ResultLevel (json:"level,omitempty") to the sarifResult struct. The value is derived from the existing severityLevelEquivalence mapping (HIGH/CRITICAL → error, MEDIUM → warning, LOW → note, INFO → none). The field is omitted for informational results via omitempty.
• pkg/report/model/sarif_test.go: Updated all expected test results to include the ResultLevel field.

Example output

{
  "ruleId": "...",
  "ruleIndex": 0,
  "kind": "fail",
  "level": "warning",
  "message": { ... },
  "locations": [ ... ]
}

I submit this contribution under the Apache-2.0 license.