Phase 2e: add --sarif output and fix broken GitHub Action -o flag

[advaitpatel]

Summary

Adds --sarif for GitHub Code Scanning integration — the last item in the Phase 2 CI
primitives sequence. While wiring it into the GitHub Action, found and fixed a real bug:
entrypoint.sh still passed the removed -o/--output flag, so any workflow setting the
Action's output input has been failing outright since the Phase 0 cleanup.

Changes

SARIF output

• --sarif: writes a SARIF 2.1.0 report, independent of --format (always written
  when the flag is set, regardless of which other formats are selected).
• One SARIF rule per unique vulnerability ID, one result per finding. Severity maps to
  SARIF levels (CRITICAL/HIGH -> error, MEDIUM -> warning, LOW/UNKNOWN -> note).
  PrimaryURL becomes the rule's helpUri when present.
• Result locations point at the scanned Dockerfile/compose file; image-only scans (no
  file on disk) fall back to the image name so results are never dropped. Compose
  findings get a line-number region parsed from their file:service:line Target.
• Appears in both the human report summary and --json's report_files.

GitHub Action fix

• entrypoint.sh no longer passes -o (removed in Phase 0); output now maps to
  --output-dir. Added output_dir, severity, fail_on, format, and sarif as new Action
  inputs so the Phase 2 CLI surface is usable from the Action.
• output is kept as a deprecated alias for output_dir so existing workflows keep working.

Testing

• ruff check . passes.
• pytest: 141 passed (+15: SARIF structure/dedup/region/severity-mapping/fallback
  tests, plus CLI-level --sarif wiring tests).
• Manual runs verified: valid SARIF 2.1.0 output, combos with --json/--format/--fail-on,
  image-only artifact fallback, and entrypoint.sh syntax.

Notes

This closes out Phase 2 (CI primitives): --severity, --fail-on + exit codes,
--format/--output-dir, --json, --sarif.