[Docs] SARIF output is documented as unreleased #1374

Summary

SARIF output shipped, but two docs pages still describe it as upcoming:

• website/docs/getting-started.md shows #cve-lite . --sarif (Coming soon)
• website/docs/how-it-works.md says "SARIF output is planned" and links to a 404 issue in the old repository

Expected

Document --sarif as a supported command and link to the existing website/docs/sarif.md guide. The "Standards-based output" section should also mention JSON, SARIF, and SBOM output.

Fix

PR: #1369