Static sca auto upload and fetch violations

[attiasas]

• The pull request is targeting the dev branch.
• The code has been validated to compile successfully by running go vet ./....
• The code has been formatted properly using go fmt ./....
• All static analysis checks passed.
• All tests have passed. If this feature is not already covered by the tests, new tests have been added.
• Updated the Contributing page / ReadMe page / CI Workflow files if needed.
• All changes are detailed at the description. if not already covered at JFrog Documentation, new documentation have been added.

---

Depends on:

• Xray Get Violations API jfrog-client-go#1186

Static-SCA Improvements:

1. Automatic cdx upload of audit/git audit scan results (you can control which repo by --upload-rt-repo-path),
   A note is added with a link to the scan results that were uploaded.
2. Wait, fetch, and parse Xray violations using the new API call (generated by JPD for the cdx artifact)
3. upload-cdx: Wait for results to be parsed by Xray before showing the link.

Other Improvements:

1. Add --sbom option to git-audit cmd
2. INFO level Log, extra msg text. and links Improvements & Fixes. (add durations to scans)
3. Little code refactors to remove code duplications
4. Align BOM REF to reflect REF in Xray (pkg:/file: prefix, / as delimiter)
5. Add fail build attribute to simple-json format.
6. Refactor convertors interface (remove redundant target input for each method)
7. dump final cdx format file to out-dir if requested
8. SARIF format - violations will now be displayed at a different run

[hadarshjfrog]

reminder