Prevent ambiguous SARIF repo attribution

Fixed an issue where security findings from scans of multiple repositories could be incorrectly attributed to the first repository in SARIF reports. The system now omits repository provenance information when multiple repositories are scanned together, avoiding mis-attribution of later repositories' findings.