Implement `uv tool audit` (#20921)
## Summary
~~WIP, not ready for review yet.~~
This is like `uv audit`, but for the `uv tool`
interface.
The main things we have here are:
- `uv tool audit` audits all installed tools
- `uv tool audit <tool>` audits just `<tool>`
This is currently under double preview: it's under the "audit" feature
like the rest of `uv audit`,
and it's under "tool-install-locks" for the
`uv tool` feature that actually produces `uv.lock` during tool
installation.
Misc notes:
- `--output-format=json` and `--output-format=sarif` are both supported,
although perhaps we could remove these for the MVP (no strong opinion
from me). For the SARIF output I've chosen to partition each audit
result into a SARIF "runs" object, with an `automationDetails.id`
reflecting the tool that was audited.
- Technically we have a _triple_ feature requirement here, since
`--output-format=json` is also under preview.
- Does `uv tool audit` auditing everything make sense? Maybe it should
be `uv tool audit --all` instead?
## Test Plan
Added integration tests covering the new surfaces.
Closes https://github.com/astral-sh/uv/issues/19886
---------
Signed-off-by: William Woodruff <william@yossarian.net>
