Fix SARIF formatter silently dropping findings from build dependencies

[mbarbero]

The sarif formatter was only checking PackageDependencies when collecting findings for a package, missing findings where the purl matched a BuildDependency. Rules like
github_action_from_unverified_creator_used assign findings a purl corresponding to a GitHub Actions build dependency, which caused those findings to appear in 'pretty' output but not in 'sarif' output.

Also add deduplication via a seenPurls map to avoid adding the same findings twice if a purl appears in both lists.

Adds TestSarifFormatBuildDependencyFindings to cover this case.

Fixes #390

[fproulx-boostsecurity]

Thanks again for the contribution @mbarbero

If I look at SARIF output for the other findings , they all have locations, but those don't have at the moment... We need to see how to make that minimally useful.

        {
          "properties": {
            "boost/confidence": "low"
          },
          "ruleId": "github_action_from_unverified_creator_used",
          "ruleIndex": 4,
          "level": "note",
          "message": {
            "text": "Usage of the following GitHub Actions repositories was detected in workflows\nor composite actions, but their owner is not a verified creator."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": ""
                },
                "region": {
                  "startLine": 1,
                  "endLine": 1
                }
              }
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "4a4dd91e418258786df104ae4c98b9c2dc7c6da4fb9f69c157b903beecd331b8"
          }
        },

vs

{
          "properties": {
            "boost/confidence": "medium"
          },
          "ruleId": "injection",
          "ruleIndex": 3,
          "level": "warning",
          "message": {
            "text": "The pipeline contains an injection into bash or JavaScript with an expression\nthat can contain user input. Prefer placing the expression in an environment variable\ninstead of interpolating it directly into a script."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": ".github/workflows/level1.yml"
                },
                "region": {
                  "startLine": 31,
                  "endLine": 31
                }
              }
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "f0d341a136d8750346e05abb89ccbceb257c5cc99d9cefb86917081ecb699977"
          }
        },

[mbarbero]

Indeed 🤦. The patch has been revamped, and all SARIF output for those findings now have locations.

Also fixed known_vulnerability_in_build_platform (that used input.provider as the finding URL) to use pkg.purl so findings are discoverable by the formatter.