feat: Milestone 0.9 (+ 1.0 groundwork) — runnable, integrable, operable - #9

SARIF 2.1.0 is the universal analysis format (CodeQL/Semgrep/Trivy/Grype …), so
one adapter lets Ravelin ingest almost any scanner — and its own CI's SARIF.

- SarifAdapter maps runs[].results[] → IncomingFinding: identity is (ruleId,
  artifact file, line); severity from the CVSS-style security-severity property
  when present (as CodeQL emits), else the SARIF level; FormatException on a
  non-SARIF payload (can't masquerade as a clean scan).
- POST /api/ingest/sarif (API-key auth, ingest rate-limit), mirroring the other
  native adapters.
- 6 unit tests (CodeQL security-severity, level fallback, rule-level lookup,
  dedup, empty runs, non-SARIF rejection).

Makes 'self-hosted' real: 'docker compose up --build' brings up the app + SQL
Server, migrated and demo-seeded, at http://localhost:8080 — no Azure needed.

- compose.yaml (app built from Dockerfile + mssql/server, healthcheck-gated
  startup, migrate-on-boot, Seed__DemoData=true, Registration__Mode=Open) and
  .env.example (secrets; .env is gitignored).
- Fix a latent Dockerfile bug: the manifest COPY omitted Ravelin.Infrastructure.csproj,
  so 'dotnet restore' (hence 'docker build') would fail. The SDK-container deploy
  path never exercised the Dockerfile, so this went unnoticed.
- README: Docker Compose quickstart as the primary local path.

NOTE: could not run 'docker compose up' in this environment (no Docker); the
compose file parses and the Dockerfile restore-graph is now complete, but a live
'up' should be smoke-tested.

- Startup no longer swallows a migration failure in Production: a failed/partial
  MigrateAsync now fails startup (fail closed) so the app never serves against a
  mismatched schema. Seeding stays best-effort. (Non-Production still logs and
  continues, so local dev without a DB doesn't hard-crash.)
- Azure pipeline Deploy stage polls /health/ready after rolling the image and
  fails the deploy if the new revision doesn't become healthy — a bad deploy is
  signalled instead of silently serving errors (previous revision is retained).

- CHANGELOG.md (Keep a Changelog): Unreleased 0.8/0.9/1.0 work + a summary of
  what shipped in the initial build.
- docs/CONFIGURATION.md: every setting, its default, and whether it's a secret —
  the operator reference a 1.0 needs.

Infra hardening from the code review (applied via terraform apply / re-running
bootstrap by the operator):

- CI/CD identity dropped from RG Contributor to a custom role scoped to the one
  Container App (read/write + revisions), so a compromised pipeline can't delete
  SQL, read storage keys, or tear down the app/Key Vault. AcrPush kept.
- bootstrap-tfstate.sh enables blob versioning + soft-delete on the state account
  (which holds every secret in plaintext) so it survives an accidental
  overwrite/delete. Network default-deny / shared-key-disable left out (need
  backend-auth coordination to avoid locking Terraform out).

terraform validate: clean.