Add Locations to the Docker scan results on Sarif output

Using the jfrog cli to scan a docker image using '--format sarif' produces a sarif file not accepted by GitHub Security Centre due to the locations field missing for the results set [GH1001]

Steps To Reproduce:

Prerequisite: use a jfrog instance setup with a remote docker repository (https://registry-1.docker.io/)

1. Pull nginx:latest - jf docker pull <rt_instance>/nginx:latest
2. Scan nginx:latest using sarif format,
   jf docker scan <rt_instance>/nginx:latest --format sarif
3. Upload sarif output to https://sarifweb.azurewebsites.net/Validation and select 'GitHub Integration rules' there are a few issues, the one which GitHub explicitly complains about is GH1001 in the results.

Expected:
GH1001 issue is addressed so the Sarif output is accepted by GitHub when uploaded to GitHub Security Centre

Other:
Example of sarif file of nginx is attached
jfrog-docker-scan-of-nginx-latest-2.50.2.sarif.json.gz

Start with the jf docker scan path that generates SARIF output, then reproduce the nginx:latest scan against a remote Docker repository. Validate the generated file with the SARIF validator and GitHub Integration rules; done means each relevant result has the required locations field and the output is accepted.