refactor(sarif): replace the trailing positional parameters with an options object

[prx-my]

Closes #1244.

Converts the trailing optional parameters of the two SARIF entry points to a
single options object, keeping findings, lockfileUri, version and plan
positional:

• buildSarifOutput(findings, lockfileUri, version, plan, options?)
• writeSarifReport(findings, lockfileUri, plan, options?)

options carries overrideFindings, maintenanceFindings, licenseFindings
and overrideSkipped; the writer adds outputDir. Behaviour is unchanged.

Replaces the two brittle write-outputs tests that asserted call arity and the
full positional list with assertions on the options object. Call sites that pass
only the leading arguments are untouched.

Verified: npm run lint:tests, npm run build, advisories sync,
npm test (163 suites / 2249 tests).

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[prx-my]

Update: this branch has been refreshed with the latest main. It is no longer behind and now only awaits the required review/status checks before it can merge.