Improve Sarif Output Format with the MappedTo property

Our sarif output already provides repository relative file locations but the sarif validator also recommends providing a mapped to attribute.

Provide information that makes it possible to determine the repo-relative locations of files that contain analysis results. Each element of the 'versionControlProvenance' array is a 'versionControlDetails' object that describes a repository containing files that were analyzed. 'versionControlDetails.mappedTo' defines the file system location to which the root of that repository is mapped. If 'mappedTo.uriBaseId' is present, and if result locations are expressed relative to that 'uriBaseId', then the repo-relative location of each result can be determined.

https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317610

Sample from spec

{
  "originalUriBaseIds": {
    "HOME": {
      "uri": "file:///home/user"
    }
    "PACKAGE_ROOT": {
      "uri": "package",
      "uriBaseId": "HOME"
    },
  },
  "versionControlProvenance": [
    {
      "repositoryUri": "https://github.com/example-corp/package",
      "revisionId": "b87c4e9"
      "mappedTo": {
        "uriBaseId": "PACKAGE_ROOT"
      },
    },
    {
      "repositoryUri": "https://github.com/example-corp/plugin1",
      "revisionId": "cafdac7"
      "mappedTo": {
        "uriBaseId": "PACKAGE_ROOT"
        "uri": "plugin1",
    },
    {
      "repositoryUri": "https://github.com/example-corp/plugin2",
      "revisionId": "d0dc2c0"
      "mappedTo": {
        "uriBaseId": "PACKAGE_ROOT"
        "uri": "plugin2",
    }
  ],
  "results": [
    {
      "ruleId": "CA1000",
      "locations": [
        {
          "physicalLocation": {
            "artifactLocation": {
              "uri": "plugin1/x.c",
              "uriBaseId": "PACKAGE_ROOT"
            }
          }
        }
      ]
    }
  ]
}

No source files or tests are named. Start at the SARIF output generation entry point and compare its versionControlProvenance serialization with the linked SARIF specification. Done means the output includes the appropriate mappedTo information and passes SARIF validation.