refactor(render/sarif): split into submodule directory (#57 3/3)

[Metbcy]

Final part of #57 (module size budget round 2). Follows #62 (run.rs) and #64 (maintainer.rs).

What

src/render/sarif.rs (1205 LOC) split into src/render/sarif/:

• mod.rs (73): docstring, consts, module decls, pub use document::render
• document.rs (32): pub fn render orchestrator
• rules.rs (128): fn rules + fn rule
• results.rs (350): fn results (the twelve-loop finding emitter)
• helpers.rs (58): fingerprint, plugin_sarif_level, synthetic_location, sarif_level
• tests.rs (588): #[cfg(test)] mod tests

Biggest non-test file: results.rs at 350 LOC.

Behavior change

None. Pure mechanical cut-paste. Public path crate::render::sarif::render preserved (verified via src/run.rs:403). fingerprint had been pub(crate) but has zero out-of-module callers — narrowed to module-private (tests reach it via #[cfg(test)] re-export in mod.rs).

Verification

• cargo test --lib: 429 passed, 0 failed
• cargo clippy --all-targets -- -D warnings: clean
• cargo test --lib render::sarif: 17 passed

Closes #57

After this merges, all three splits (run.rs, maintainer.rs, sarif.rs) are in. Crate's biggest non-test file drops from 1284 LOC to <600.

[github-actions]

Coverage report

Line coverage: 83.6% (9129 / 10921 lines)

Full lcov report available as workflow artifact coverage-lcov: download from this run.

_{v0.9.8 introduces this report; --fail-under-lines will be added once coverage is visible across 2–3 releases.}