Include source file location information: line & character numbers

**What would you like to be added**:
File sources with line numbers

**Why is this needed**:
A number of tools, including Visual Studio Code and [Github](https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning#example-with-minimum-required-properties), require or otherwise need line numbers to provide more useful reporting to the end user. Github _requires_ line numbers, but we are currently [hardcoding this to line 1](https://github.com/anchore/scan-action/blob/main/index.js#L223-L231), which [does not provide an especially useful rendering](https://github.com/kzantow-anchore/scan-action-test/security/code-scanning/5?query=ref%3Arefs%2Fheads%2Fmain) if a user tries to figure out where a problem originated:

**Additional context**:
There are 2 other tickets related to this in [grype anchore/syft#1208](https://github.com/anchore/syft/issues/1208) and [the vs code extension anchore/grype#2](https://github.com/anchore/grype-vscode/issues/2)

Review the source-location request and the related Syft issue #1208 and grype-vscode issue #2. Then inspect the SARIF output path referenced through scan-action/index.js lines 223-231, where locations are currently hardcoded to line 1. Done means preserving line and character locations so GitHub and Visual Studio Code can identify the finding's source.

Written by the indexing model from the issue text.