feat(report): add PURLs in sarif report

[axidex]

Description

Adding PURLs to Rule.Properties in SARIF output.
This brings Trivy SARIF reports to parity with Grype, which already exposes PURLs in rules[].properties.purls, so downstream tooling can correlate SARIF findings back to components in an SBOM.

PURLs are only added to vulnerability rules -- misconfiguration, secret, and license rules are unchanged.

Output

Before

"properties": {
    "cvssv2_score": 5,
    "cvssv2_vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
    "cvssv3_baseScore": 5.3,
    "cvssv3_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
    "precision": "very-high",
    "security-severity": "5.3",
    "tags": [
      "vulnerability",
      "security",
      "MEDIUM"
    ]
}

After

"properties": {
    "cvssv2_score": 5,
    "cvssv2_vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
    "cvssv3_baseScore": 5.3,
    "cvssv3_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
    "precision": "very-high",
    "purls": [
      "pkg:apk/alpine/libcrypto1.1@1.1.1c-r0?arch=x86_64\u0026distro=3.10.2",
      "pkg:apk/alpine/libssl1.1@1.1.1c-r0?arch=x86_64\u0026distro=3.10.2"
    ],
    "security-severity": "5.3",
    "tags": [
      "vulnerability",
      "security",
      "MEDIUM"
    ]
}

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[DmitriyLewen]

Hello @axidex
Thanks for your work!

Please first create a discussion so that we can assess how much this functionality is needed by the community.Please first create a discussion so that we can assess how much this functionality is needed by the community.
If the functionality is in demand — we will review this PR.

Regards, Dmitriy

[axidex]

Looks like flaky.
Could you please rerun test?

Error:      	Received unexpected error:
        	            	connection error: desc = "transport: Error while dialing: dial unix /tmp/TestContainerd_LocalImage1059336103/001/containerd/containerd.sock: connect: permission denied"

[axidex]

Hello @axidex Thanks for your work!

Please first create a discussion so that we can assess how much this functionality is needed by the community.Please first create a discussion so that we can assess how much this functionality is needed by the community. If the functionality is in demand — we will review this PR.

Regards, Dmitriy

#10725