Improve SAST monorepo SARIF coverage gates

[danyili2632]

Summary

• add monorepo workspace coverage inventory requirements before scoring SAST maturity
• add SARIF completeness gates for path/category metadata, generated/vendor LOC inflation, nested CodeQL extraction, and base-branch-only PR scans
• extend CodeQL, CI, severity, and report output sections with per-component scan evidence

Bounty

Addresses #1527.

I have read and agree to the CONTRIBUTING.md bounty terms. Preferred payment method can be provided privately after maintainer acceptance.

Validation

• git diff --check