workflows: enable sarif output for CIFuzz

[DavidKorczynski]

This will make it easier to interpret the output of CIFuzz by making it possible to view the result in the Github security page.

---

Enter [N/A] in the box, if an item is not applicable to your change.

Testing
Before we can approve your change; please submit the following in a comment:

• [N/A] Example configuration file for the change
• [N/A] Debug log output from testing the change

• [N/A] Attached Valgrind output that shows no leaks or memory corruption was found

If this is a change to packaging of containers or native binaries then please confirm it works for all targets.

• [N/A] Run local packaging test showing all targets (including any new ones) build.
• [N/A] Set ok-package-test label to test for all targets (requires maintainer to do).

Documentation

• [N/A] Documentation required for this feature

Backporting

• [N/A] Backport to latest stable release.

---

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

[nokute78]

This PR may cause CI Fuzz error.
https://github.com/fluent/fluent-bit/actions/runs/5485095155/jobs/9993466873

[jonathanmetzman]

Very weird, this has worked in the past. I have a fix here: google/oss-fuzz#10673

[nokute78]

Hmm, CI Fuzz detected some errors before merging this patch and they were ignored.
e.g. https://github.com/fluent/fluent-bit/actions/runs/5422155812/jobs/9858454501?pr=7627#step:5:91

This patch may have made it detectable.

[DavidKorczynski]

Hmm, CI Fuzz detected some errors before merging this patch and they were ignored. e.g. https://github.com/fluent/fluent-bit/actions/runs/5422155812/jobs/9858454501?pr=7627#step:5:91

This patch may have made it detectable.

I don't see an issue in that run? I think the last time CIFuzz detected and issue is here #7613 and this was due to a bug (fix mentioned in #7613 (comment) )

[jonathanmetzman]

Should be fixed google/oss-fuzz#10673

[nokute78]

@jonathanmetzman @DavidKorczynski Thank you for comment.

Recent CI Fuzz didn't report an error. It is fixed.
e.g. https://github.com/fluent/fluent-bit/actions/runs/5549017264/jobs/10132615553