feat: include DM001 maintenance findings in SARIF output

[Ayush7614]

Summary

--check-maintenance findings appear in JSON and HTML, and count toward --fail-on, but SARIF ignores them. Override findings already have SARIF builders; maintenance does not. Code Scanning can look clean while the CLI exits 1 on DM001.

Motivation

Parity today:

Surface	CVE	Overrides (OA/PD)	Maintenance (DM001)
Terminal	yes	yes	yes
--json	yes	yes (maintenanceFindings)	yes
--report HTML	yes	yes	yes
--sarif	yes	yes (override-findings-sarif)	no

src/output/write-outputs.ts passes overrides into writeSarifReport but never maintenance:

writeSarifReport(sorted, lockfileUri, plan, scanState.overrideFindings);

src/output/sarif.ts accepts overrideFindings only.

Proposed behaviour

1. Add a maintenance → SARIF result builder (mirror override-findings-sarif.ts): rule id DM001, severity mapping, message/help text.
2. Thread maintenanceFindings through writeSarifReport / buildSarifOutput.
3. Unit tests: DM001 present in SARIF when --check-maintenance findings exist; absent when flag off / empty.
4. Short docs note in SARIF / maintenance / CLI reference if those pages mention output formats.

Non-goals

• Multi-folder SARIF (still explicitly unsupported)
• Changing DM001 detection semantics

Acceptance criteria

cve-lite . --check-maintenance --sarif
# .sarif contains DM001 rule + results when findings exist

GitHub Code Scanning upload surfaces DM001 alongside CVE/OA results.

Happy to take this if the SARIF rule metadata shape looks good.