Use sarif output of golang.org/x/vuln/cmd/govulncheck

Use sarif output of golang.org/x/vuln/cmd/govulncheck #1077