Evaluate the use of Sarif instead of Reviewdog

## Pro

- It's supported by GitHub natively
- Fancy new thingy

## Cons

- We need to port the checks we have
- We need to rewrite the missing checks (xmllint one, maybe)
- We need to rewrite and get the other scripts working:

* tfsec with multi-dir support, and proper diffing
* xmllint that does not support any output if not text
* blocklist for semgrep findings and custom rulesets

## Open Qs

- Rather limited console support, so slow iteration (maybe?)
- How do we test that the serif output is fine? Is there any validator?