jf audit: SARIF format is missing most of the fields provided by the JSON format

Describe the bug

SARIF format is not on-par with the JSON format.

Current behavior

SARIF format is missing most of the JSON format information:

• No license (FOSS) information at all
• CVSS Vector
• Impacted paths
  • In-case of a multi-maven project, the uri is "pom.xml" (no module prefix) with startLine, startColumn and endLine set to 0.
• Fixed versions
• All of the extended information (from the R&D enrichment)
  • Haven't verified the contextual analysis, but my guess is, it is also missing
• References

Note:

• I validated the sarif output and apparently it isn't following the SARIF format properly as well, see https://sarifweb.azurewebsites.net/Validation to validate a SARIF file

Reproduction steps

1. Perform a scan with the JSON format
2. Perform a scan with the SARIF format
3. Compare the 2

Expected behavior

SARIF format is on-par with the JSON format in term of information provided.

JFrog CLI version

2.42.1

Operating system type and version

Docker

JFrog Artifactory version

No response

JFrog Xray version

No response

Start by reproducing the issue with JFrog CLI 2.42.1, comparing JSON and SARIF scan output and validating the SARIF file with the linked validator. Trace the SARIF output entry point and its handling of licenses, CVSS, paths, fixed versions, enrichment, contextual analysis, and references; done means the output is comparable in information and passes SARIF validation.