ci(rust.yml/jobs/clippy): integrate with GitHub Code Scanning

[DataM0del]

Description

See CCBlueX/LiquidBounce#4887, it's basically this but for detekt (because that's what LiquidBounce uses for linting their Kotlin part).

This PR pretty much just adds more QoL. Nothing really useful for anyone who isn't reviewing the code for PRs.
See https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning#about-third-party-code-scanning-tools
Also, you can probably open up the results.sarif file in any JetBrains IDE (e.g. IntelliJ IDEA) with Server-side Analysis and see all linting errors.

Testing

• See if CI passes
• After CI passes, intentionally make clippy trigger a warning
• Observe the results and see if it works

Checklist

Things need to be done before this Pull Request can be merged.

• Code is well-formatted and adheres to project style guidelines: cargo fmt
• Code does not produce any clippy warnings: cargo clippy

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[DataM0del]

I forgot it to install clippy-sarif in the release mode linting job 💀

[DataM0del]

Now let's trigger clippy.

[DataM0del]

Now let's revert it!

[DataM0del]

[DataM0del]

It says fixed now.

[Snowiiii]

So, What does this do ?

[DataM0del]

So, What does this do ?

It adds a "review" that comments on each line that clippy screams at, instead of you having to go look at the CI logs for the clippy job.

[Snowiiii]

I don't think this is really needed, I think its more annoying that actually useful. People also don't really have to go into the CI logs. They can just see what CI failed and then fix it locally