satisfy some sonarcloud notes

only get PR review info for actual PR events

keep suggestions within 1 diff hunk

- only dismiss reviews that can be dismissed
- use default SHA for review commit_id
- only use start_line if it precedes end line
- use actual line numbers
- prevent posting blank suggestions
- don't add a new line at end of each suggestion
- some code cleanup

post review payload as json -- oops

only create a Patch when creating a review
use 1 review for both tools
don't post reviews for PRs marked as "draft"

make patch coverage informational (not a gate)

reduce test permutations to only what is needed