SARIF output always reports level=warning, ignoring the vulnerability's severity

The SARIF output (`--format sarif`) always sets every result's `level` to `"warning"`, no matter how severe the vulnerability is:

https://github.com/google/osv-scanner/blob/main/internal/output/sarif.go#L356

This is a bit odd because a CVSS score/rating is already computed a few lines above (for the `security-severity` rule property), so the data needed to pick a better level is right there in scope, just not used for `level` itself.

The practical effect: in GitHub code scanning (and any other SARIF consumer that cares about `level`), a critical RCE and a low-severity denial-of-service look identical — everything shows up as a plain warning, so you can't sort/filter by severity or have it show up as a blocking check for high-severity findings only.

Happy to send a small PR mapping the existing CVSS rating (Critical/High -> `error`, Medium/Low/unknown -> `warning`, matching current behavior when there's no score) if that sounds reasonable — wanted to check first per the contributing guide before opening one.

Start in internal/output/sarif.go around line 356, where the SARIF result level is assigned, and inspect the CVSS rating computed a few lines above. Verify how the existing rating and no-score case are represented, then ensure the SARIF level reflects the stated severity mapping while preserving warning behavior without a score.

Written by the indexing model from the issue text.