[spike] perhaps cabal-plan-submit could enrich static-code-analysis SARIF for stan

[dancewithheart]

cabal-plan-submit already enrich SARIF produced by cabal-audit to produce code scan reports in Github.

There is open work for producing SARIF output for code scan for stan - static code analysis: kowainik/stan#483

Perhaps existing JIRA workflow could be updated to use this or modernize stan / update and merge SARIF PR.