reports: SARIF location enrichment and HTML self-containment

## Goal
Improve report fidelity.

## Work items
- SARIF: emit region info (line/column) from SourceLocation when available
- HTML: inline fonts/CSS fully for offline viewing; add shareable filter state in URL hash
- Markdown: collapsible sections per severity for large result sets