enhance sarif output (closes #2608)

[tarunKoyalwar]

Description

Fix and Enhance Static Analysis Results Interchange Format (SARIF) Output

closes #2608

Changes

• Removed dependency adopted https://github.com/projectdiscovery/sarif
• Enhanced / Extra Output
• Compatible with GitHub-Sarif including security related metadata . (supports Unable to upload "nuclei.sarif" as it is not valid SARIF nuclei-action#43 )

Run Below Command to verify

nuclei -u https://scanme.sh -se report.sarif

Supported Viewers

Generated sarif output is compatible with all available Sarif viewers

1. Sarif-WebComponent
2. [VSCode-Extension](Sarif Viewer)
3. Github repository security -> Code Scanning

Note:

impact & severity , title is properly configured in PR . below screenshots were created using random data to match testcases hence result is messed up actual/new report generated is proper without errors

[tarunKoyalwar]

Nuclei will probably be receiving UI soon . Currently there are 2 options available to visualize nuclei outputs using SARIF

1) Using SARIF Web Component

Visit Web-Component and upload generated SARIF file using open at top right corner .

Example nuclei generated sarif file : https://gist.github.com/tarunKoyalwar/f76fc7b55c29e69b1ea1d02f4d6661a8
UI is clean and Minimal and results are grouped based on templates with hyperlinks to hosts

2) Using Github Security page of repo

   - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@v2
        with:
          # Path to SARIF file relative to the root of the repository
          sarif_file: results.sarif

can be used along with nuclei-actions or any other method to upload SARIF to security page of that repo . Output location is same as CodeQL i.e security -> Code Scanning

UI has many filters as show in above image and alerts are scoped to organization level

[Mzack9999]

merge conflict - go mod tidy should suffice

[Mzack9999]

lgtm!

$ go run . -u https://scanme.sh -se report.sarif
...
[2022-11-30 12:25:39] [self-signed-ssl] [ssl] [low] scanme.sh

[tarunKoyalwar]

Fixed issue related to result title
Updated result title format

[tarunKoyalwar]

@ehsandeep , currently nuclei-actions does not upload sarif to security page , maybe we can make it upload to security page by default