expose tool annotation for sast scans generated as GITLAB_SECURITY_REPORT

[migmartri]

SARIF or SBOM files when ingested by Chainloop, are accompained with a tool annotation

For example

"materials": [
      {
        "annotations": {
          "chainloop.material.cas": true,
          "chainloop.material.name": "coverity-report",
          "chainloop.material.tool.name": "Coverity",
          "chainloop.material.tool.version": "2022.12.1",
          "chainloop.material.type": "SARIF"
        },
        "digest": {
          "sha256": "a9a1eb20b0ef219b5e94fde7cf9cc6b65287f92801134b252c8ecbe92561b2aa"
        },
        "name": "coverity-scan.json"
      }
    ],

For GITLAB_SECURITY_REPORT we do not extract that information, and in some cases we might have it, like for example here

{"version":"15.0.0","scan":{"analyzer":{"id":"SONARQUBE 2025.1.1.104738","name":"SONARQUBE - Enterprise","vendor":{"name":"Sonar"},"version":"2025.1.1.104738"},"scanner":{"id":"sonar_scan","name":"Sonar","vendor":{"name":"Sonar"},"version":"11.2.0.2797"},"start_time":"2025-10-20T20:18:45","end_time":"2025-10-20T20:18:45","status":"success","messages":[],"type":"sast"},"vulnerabilities":[]}