buildifier: add SARIF output (--format=sarif) (#1529)

Adds SARIF 2.1.0 as a third diagnostics format next to `text` and
`json`. SARIF is understood by many CI, IDE and code-quality tools.
Fixes #1528.

## Usage

```
buildifier --mode=check --lint=warn --format=sarif -r . > buildifier.sarif
```

As with `json`, `--format=sarif` only works with `--mode=check`, and
`-v` indents the output.

## Mapping

- Each lint warning becomes a result at level `warning`. Its `ruleId` is
the warning category, `helpUri` is the WARNINGS.md link, and the region
is the start and end line and column.
- A file that needs reformatting becomes a file-level result (no region)
with rule `format`, level `warning`.
- A file that can't be parsed becomes a file-level result with rule
`parse-error`, level `error`.
- Rules are deduplicated per category.
- With no findings, the output is still a valid log with empty `rules`
and `results`.

## Design notes

- The serializer is a small in-tree struct set, so it adds no
dependency.
- Findings carry no severity today (only `actionable`, which `warn.go`
always sets to `true`). So every lint finding is a `warning`.
- `autoFixable` is not mapped. It would need SARIF `fixes` with
replacement text, which can come in a follow-up.
- A `format` finding has no region, because buildifier doesn't track
where the formatting differs.
- `artifactLocation.uri` is the path as passed on the command line, so
run from the repo root with relative paths for repo-relative URIs.

## Commits

1. Serializer (`utils/sarif.go`), unit tests, and the `Format` hook-up.
2. Accept `--format=sarif` in `--mode=check` and update the help text.
3. README section.
4. Integration tests with goldens, covering many files, a single file,
stdin and an invalid file.

## Additional testing

- Sample outputs validate against the official OASIS SARIF 2.1.0 schema.

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>