SARIF "ruleId" for NPM findings is just a number; should be NPM- prefixed

**Describe the bug**
In SARIF report output, the "ruleId" for NPM findings is just a number. That make it hard to understand what database to look that number up in, adding the NPM- prefix would make the meaning of the number much more obvious.

For example, here's an excerpt from a SARIF report:
```json
"results": [ {"ruleId": "1070273","level": "warning","message": {"text": "1070273 - ansi-regex is vulnerable to Inefficient Regular Expression Complexity"},"partialFingerprints": {"vulnerabilityHash": "ecc887814803262bb6af684fd4dd8791"},"locations": [{"physicalLocation": {"artifactLocation": {"uri": "\/src\/frontend\/yarn.lock?ansi-regex","index": 16094 }},"logicalLocations": [{"fullyQualifiedName": "pkg:npm\/ansi-regex@3.0.0"}]}]}]
```

In the HTML report, the information presented is much more helpful/readable:

Note that the SARIF report generator already has code to special handle NPM and add the `NPM-` prefix in another place:
https://github.com/jeremylong/DependencyCheck/blob/07bd05189ee4a3635365bd72e8d265c4ea49385e/core/src/main/resources/templates/sarifReport.vsl#L23

**Version of dependency-check used**
cli version 7.1.0

**Log file**
n/a

**To Reproduce**
Steps to reproduce the behavior:
1. Run OWASP dependency check on a project that has NPM findings
2. View the SARIF report

**Expected behavior**
The `ruleId` field should contain a full reference uniquely identifying the finding; part of that unique identifier should be the database (in this case `NPM`).

**Additional context**
Add any other context about the problem here.