rules lists every distinct FindingCode actually present in this run,
sorted -- not the full FindingCode union. A SARIF consumer treats the
rules array as "what this tool reported", and advertising rules that
produced no result makes a clean run look like it has unexplained silent
rules. results preserves Finding Model's own order, which a caller wanting
a different one sorts themselves.
Projects Finding Model into a SARIF 2.1.0 log.