SARIF: Take uncalled vulnerabilities into account

And potentially surface call stacks in cases where vulnerabilities are called through [`codeFlows`](https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning#result-object)