Multiple updates to finish out the initial launch of the semgrep analyzer

What does this MR do?

• Fix root paths to be relative to project root
• Update Dockerfile to give control over base image
• Update sarif package to be more flexible

What are the relevant issue numbers?

gitlab-org/gitlab#299585 (closed)

Does this MR meet the acceptance criteria?

• Changelog entry added
• Tests added for this feature/bug
• Conforms to the code review guidelines
• Conforms to the Go guidelines
• Security reports checked/validated by reviewer