fix(report): preserve full finding metadata in SARIF output (#229)

[rodboev]

Summary

--format sarif currently drops finding metadata that --format json already preserves. This makes SARIF a lossy export path for downstream tooling that needs category, pattern, confidence, finding summaries, explanations, remediation, snippets, intent, tags, and precise end-line data.

Closes #229

Root cause

_build_sarif() builds each result from only the core SARIF fields and never carries the richer Finding metadata that the JSON formatter already serializes. The current SARIF models also lack a result properties bag, so the report layer has no standard place to preserve those fields.

Diff Notes

• Extend SarifResult so the report layer can preserve SkillSpector-specific finding metadata in a SARIF-compatible properties bag.
• Keep endLine wired through the SARIF region and carry the named JSON fields, including pattern, finding, and explanation, through the SARIF result path.
• Preserve rules generation, sorting, empty-finding filtering, and suppression markers.
• Add focused regression coverage for metadata fidelity and suppression preservation.

Scope

This change is limited to report and SARIF schema code. It does not change analyzers, JSON output, CLI behavior, transitive scanning, baseline matching, or provider and MCP behavior.

Verification

• ./.venv/Scripts/python.exe -m pytest tests/nodes/test_report.py tests/nodes/test_sarif_rules_and_empty_findings.py (62 passed, 1 warning)
• uv run ruff check src/ tests/
• uv run ruff format --check src/ tests/