fix(sarif): handle empty artifactLocation.uri fields

[nikpivkin]

Related Issues:

• Issue with uploading the SARIF report to GitHub trivy-action#408

In some cases, Trivy generates a SARIF report with an empty artifactLocation.uri. Although such reports successfully pass validation at https://sarifweb.azurewebsites.net/Validation, which is recommended by GitHub in their documentation, uploading them using the github/codeql-action/upload-sarif action fails with the following error:

Error: Code Scanning could not process the submitted SARIF file:
locationFromSarifResult: expected artifact location, locationFromSarifResult: expected artifact location

This remains an unresolved issue:

• Error while uploading SARIF file using action github/codeql-action/upload-sarif github/codeql-action#2456
• Valid SARIF file being rejected by GitHub with locationFromSarifResult error microsoft/sarif-sdk#2770

Potential solutions:

1. Remove results that do not meet the criteria from the report and log this.
2. As suggested in a discussion, populate the artifactLocation.uri field with a dummy value.