Update upload-sarif action to v3

[carstenhag]

    permissions:
      # required for all workflows
      security-events: write

https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github#example-workflow-for-sarif-files-generated-outside-of-a-repository