feat(report): add licenses to sarif format

[nikpivkin]

Description

Added licenses to the SARIF format report.

Example output:

{
  "version": "2.1.0",
  "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
  "runs": [
    {
      "tool": {
        "driver": {
          "fullName": "Trivy Vulnerability Scanner",
          "informationUri": "https://github.com/aquasecurity/trivy",
          "name": "Trivy",
          "rules": [
            {
              "id": "alpine-base:GPL-3.0",
              "name": "License",
              "shortDescription": {
                "text": "GPL-3.0 in alpine-base"
              },
              "fullDescription": {
                "text": "GPL-3.0 in alpine-base"
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "help": {
                "text": "License GPL-3.0\nClassification: restricted\nPkgName: alpine-base\nPath: ",
                "markdown": "**License GPL-3.0**\n| PkgName | Classification | Path |\n| --- | --- | --- |\n|alpine-base|restricted||"
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "8.0",
                "tags": [
                  "license",
                  "security",
                  "HIGH"
                ]
              }
            },
          ],
          "version": "dev"
        }
      },
      "results": [
        {
          "ruleId": "alpine-base:GPL-3.0",
          "ruleIndex": 0,
          "level": "error",
          "message": {
            "text": "Artifact: OS Packages\nLicense GPL-3.0\nPkgName: restricted\n Classification: alpine-base\n Path: "
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "OS Packages",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "message": {
                "text": "OS Packages: alpine-base"
              }
            }
          ]
        },
      ],
      "columnKind": "utf16CodeUnits",
      "originalUriBaseIds": {
        "ROOTPATH": {
          "uri": "file:///"
        }
      },
      "properties": {
        "imageName": "alpine:3.1",
        "repoDigests": [
          "alpine@sha256:4dfc68bc95af5c1beb5e307133ce91546874dcd0d880736b25ddbe6f483c65b4"
        ],
        "repoTags": [
          "alpine:3.1"
        ]
      }
    }
  ]
}

Related issues

• Close Trivy output mismatch between SARIF and non formatted/JSON for license scanning #4862

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[erzz]

thanks!!! Really looking forward to this as I just spent hours debugging to find it was never supported :)

Can we get a quick update to the action too to start using this ASAP 🙏🏻

[erzz]

By the way this is working fantastically well for us now via the action! 🙏🏻