feat: add merge-sarif (#37)

Adding a action to merge multiple SARIF files into one. Also contains a test and example files.

Reviewed-on: t.behrendt/trivy-actions#37
Reviewed-by: branch-buddy <branch-buddy@t00n.de>
Co-authored-by: Timo Behrendt <t.behrendt@t00n.de>
Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>

merge-sarif-files/action.yaml

@@ -0,0 +1,42 @@
+name: "Merge SARIF Files"
+description: "Merge multiple SARIF files into a single SARIF file"
+author: "Timo Behrendt <t.behrendt@t00n.de>"
+branding:
+  icon: "database"
+  color: "blue"
+
+inputs:
+  files:
+    description: "Paths to SARIF files to merge"
+    required: true
+  output-file:
+    description: "Output file path"
+    required: true
+    default: "merged.sarif"
+
+runs:
+  using: "composite"
+  steps:
+    - id: merge
+      shell: bash
+      run: |
+        set -e
+        files="${{ inputs.files }}"
+        output_file="${{ inputs.output-file }}"
+
+        # Parse YAML list: lines like "  - path/to/file" or "- file"
+        file_list=$(echo "$files" | sed -n 's/^[[:space:]]*-[[:space:]]*//p' | tr -d '"' | tr -d "'")
+
+        # Collect all runs from all SARIF files (each run as one compact JSON line)
+        runs_json=$(while IFS= read -r file; do
+          [ -z "$file" ] && continue
+          jq -c '.runs[]?' "$file" 2>/dev/null || true
+        done <<< "$file_list" | jq -s '.')
+
+        # Take first file for version/schema, replace .runs with merged array
+        first_file=$(echo "$file_list" | head -1)
+        if [ -z "$first_file" ]; then
+          echo "No input files given."
+          exit 1
+        fi
+        jq -n --argjson runs "$runs_json" --slurpfile first "$first_file" '$first[0] | .runs = $runs' > "$output_file"