[core] SARIF formatter reports multiple locations when it should report multiple results

**Affects PMD Version:** 6.42.0

**Description:**

See https://github.com/pmd/pmd-github-action/issues/53 for the details.
In short, the SARIF renderer doesn't adhere to the spec and therefore not all violations are imported into GitHub's code scanning feature. Some violations get lost...

**Running PMD through:** GitHub Actions
