test(07-03): SARIF GitHub code scanning validation

- Minimal required-fields fixture for GitHub SARIF upload schema
- TestSARIFGitHubValidation: asserts $schema/version/runs, tool.driver.name,
  per-result ruleId/level/message/locations, physicalLocation.region.startLine >= 1
- Covers startLine floor for LineNumber=0 inputs
- TestSARIFGitHubValidation_EmptyFindings: empty input still yields a valid
  document with results: [] (not null)

testdata/sarif/sarif-2.1.0-minimal-schema.json

@@ -0,0 +1,9 @@
+{
+  "required_top_level": ["$schema", "version", "runs"],
+  "required_run": ["tool", "results"],
+  "required_tool_driver": ["name", "version"],
+  "required_result": ["ruleId", "level", "message", "locations"],
+  "required_location_physical": ["artifactLocation", "region"],
+  "required_region": ["startLine"],
+  "allowed_levels": ["error", "warning", "note", "none"]
+}