Feature: more granular severity of results

[laurentsimon]

We currently have criticality for checks. However, within a check, severity may vary. For example, contents: write is more critical than status: write, for example.

I think it's feasible to tell sarif to overwrite the default check severity using the level field https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning#result-object

For this to work, we need to update scorecard to report severity for each Warn: result, tracked in ossf/scorecard#1874

Related ossf/scorecard#1321