ci: upload shellcheck SARIF as security-related (#134)

We were uploading the shellcheck artifact as an artifact to download,
which doesn't get reflected in the security tab on github.  Instead, we
should be uploading it as a sarif file to be consumed by github.

Signed-off-by: Andy Sadler <ansadler@redhat.com>
Co-authored-by: Francesco Ilario <filario@redhat.com>

.github/workflows/security.yaml

@@ -87,7 +87,6 @@ jobs:
 
       - if: ${{ always() }}
         name: Upload ShellCheck defects
-        uses: actions/upload-artifact@v4
+        uses: github/codeql-action/upload-sarif@v3
         with:
-          name: ShellCheck SARIF
-          path: results.sarif
+          sarif_file: results.sarif