Automatic feedback of scan results as PR comment

I'm looking at ways go improve _engagement_ (around security) and one way is to involve my devs a little more in _everything security_.

Currently the results of a scan (can) go to the GitHub security dashboard, which is fine, but how about a sub action to create a little markdown comment inside the PR?

Simply this:
```
anchore/scan-action/pr-comment@0
```

This would look for a `sarif` file, extract the required bits and post a comment in the PR thread. There's a `markdown` field inside this file which we may want to use, or write out a different message altogether.

Thoughts?

Start by reviewing the existing scan-action workflow and how it produces the SARIF file. Define how the proposed sub-action should find the SARIF data, use or replace its markdown field, and post a comment in the PR thread. Done means the behavior and validation for an automatic scan-results comment are specified.

Written by the indexing model from the issue text.