Add senior bug review for SARIF merge and parsing issues

[prithvee07]

Motivation

• Capture a focused senior review of executable helper code addressing correctness-impacting bugs in SARIF merge and parsing logic.
• Surface high-impact failures where merging and deduplication can drop or corrupt static-analysis findings across tools and large repos.
• Provide prioritized remediation guidance and validation recommendations to prevent under-reporting and metadata collisions.

Description

• Add CODEBASE_ANALYSIS.md containing four detailed bug reports targeting merge_sarif.py and sarif_helpers.py with reproducible evidence and suggested fixes.
• Recommend concrete fixes including using SARIF fingerprints, richer deduplication keys (start/end columns and normalized message), namespacing rules by tool identity, and robust file:// URI parsing via urllib.parse.urlparse.
• Include a priority order for addressing issues and a set of recommended regression tests and fixtures to validate merges across edge cases.

Testing

• No automated tests were added or executed as part of this change.
• The document includes recommended automated regression fixtures and assertions to be implemented for future CI validation.

---

Codex Task