Bump to version 2 so we can support semgrep in the GitLab config UI while we're waiting to remove `SAST_ANALYZER_IMAGE_TAG` (!22)
Fixes paths in report relative to project root, updates sarif to support multiple runs and locations (!6)
Bandit rule-set
First pass at things