Learn about Sarif for static analysis

[nateinaction]

Related to #5

Many of the FPrime build pipelines use sarif to export results from static analysis tools like cpplint Example. I'd like to learn more about Sarif to see if it is useful for us to implement. Additionally I noticed that they're passing the sarif file to codeql and I'm curious what that does for codeql output... hmmm

https://github.com/microsoft/sarif-tutorials