fix: critical level is considered error in sarif

[teodora-sandu]

What does this PR do?

This PR makes sure that critical security issues are treated as errors in SARIF for code scanning alerts. At the moment they would be treated as warnings, which is not correct as critical is the highest severity.

How should this be manually tested?

Snyk IaC only supports critical severity via custom rules.

1. Download bundle.tar.gz
2. Clone https://github.com/snyk/custom-rules-example.
3. Run npm run build in snyk/snyk
4. Run snyk-dev iac test ./rules/CUSTOM-RULE-1/fixtures/denied.tf --rules=bundle.tar.gz in snyk/custom-rules-example to see Critical issue CUSTOM-RULE-1
5. Run snyk-dev iac test ./rules/CUSTOM-RULE-1/fixtures/denied.tf --rules=bundle.tar.gz --sarif in snyk/custom-rules-example to see that it's an error

Any background context you want to provide?

This is a byproduct of Snyk IaC investigating our existing SARIF output in https://snyksec.atlassian.net/browse/CFG-1278 and reading the documentation at https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning#supported-sarif-output-file-properties to find out if anything is missing.

Screenshots

[github-actions]

	Warnings
⚠️	Since the CLI is unifying on a standard and improved tooling, we're starting to migrate old-style imports and exports to ES6 ones. A file you've modified is using either module.exports or require(). If you can, please update them to ES6 import syntax and export syntax. Files found: src/lib/formatters/iac-output.ts src/lib/formatters/sarif-output.ts

Generated by 🚫 dangerJS against a034e57

[ghost]

Looks good! 🎉

[ofekatr]

LGTM 💯

[anthogez]

Nice work here @teodora-sandu 🎉
Could you please copy your GitHub's note into your commit's message body? Thanks!