Add opt-in SARIF upload to the GitHub Action

[LyraZeta]

Goal

Make CI findings visible directly in GitHub's Code Scanning interface without requiring users to assemble a second workflow step.

Proposed scope

• Add an opt-in Action input such as upload-sarif.
• Upload report.sarif.json with least-privilege permissions and pinned dependencies.
• Document the required security-events: write permission and fork-PR limitations.
• Keep the default disabled so existing consumers do not receive broader permissions unexpectedly.

Acceptance criteria

• A smoke workflow verifies the opt-in path.
• Missing permissions produce a clear error that points to the README example.
• The Action still uploads the interactive report artifact whether the visual lint passes or fails.