Fixes paths in report relative to project root, updates sarif to support multiple runs and locations (!6)
Bandit rule-set
First pass at things