fix(report): preserve full finding metadata in SARIF output (#229)

[rodboev]

Summary

--format sarif currently drops finding metadata that --format json already preserves. This update keeps the original finding severity in the SARIF result properties bag too, so downstream tooling can still distinguish CRITICAL from HIGH after SARIF level flattening.

Closes #229

Root cause

_build_sarif() builds each result from only the core SARIF fields and a partial properties bag. Even after the earlier metadata work, SARIF level still flattened both CRITICAL and HIGH to error, and the original severity value was never preserved alongside the other finding fields.

Diff Notes

• Extend SarifResult so the report layer preserves the original severity alongside the existing SkillSpector-specific finding metadata in the SARIF-compatible properties bag.
• Keep endLine, rule generation, sorting, empty-finding filtering, and suppression markers unchanged.
• Add focused regressions for active and suppressed metadata preservation, plus a HIGH-vs-CRITICAL check that still expects level=error for both results.

Scope

This change is limited to report and SARIF schema code. It does not change analyzers, JSON output, CLI behavior, transitive scanning, baseline matching, or provider and MCP behavior.

Verification

• .\.venv\Scripts\python.exe -m pytest tests/nodes/test_report.py tests/nodes/test_sarif_rules_and_empty_findings.py (63 passed, 1 warning)
• uv run ruff check src/skillspector/nodes/report.py tests/nodes/test_report.py tests/nodes/test_sarif_rules_and_empty_findings.py
• uv run ruff format --check src/skillspector/nodes/report.py tests/nodes/test_report.py tests/nodes/test_sarif_rules_and_empty_findings.py

[rng1995]

Requesting changes because exact finding severity is still lost. SARIF level maps both CRITICAL and HIGH to error, so the new property bag does not yet preserve full finding metadata. Include the original severity for active and suppressed results and add a distinction test.

[rng1995]

[Automated SkillSpector Review]

Re-review: approved. The prior severity-fidelity blocker is resolved: active and suppressed SARIF results preserve original severity in properties, including HIGH versus CRITICAL, while retaining SARIF level=error. Focused report/SARIF coverage passes.

[rng1995]

Fix the CI issue @rodboev

[rodboev]

Fixed. I rewrote the CI refresh commit with the missing DCO sign-off and force-pushed 0e22116. The branch diff is unchanged, this only updates the commit metadata.