Tag findings with STRIDE threat model

Security findings in SARIF reports now include STRIDE-leg tags (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) automatically derived from their CWE classifications. This enables downstream tools like GitHub's Security tab and ASPM dashboards to group and filter findings by threat model category.