Add output file support

[joshka]

Summary

This adds a generic output-file input for writing cargo-deny stdout to a file, and exposes that path as an action output.

This is intentionally narrower than the SARIF/GitHub Code Scanning idea from #110. It does not add upload behavior or any GitHub-specific SARIF handling; it only makes existing machine-readable stdout output easier to compose in workflows.

If this still feels like too much surface area for this action, I’m fine with closing it. I wanted to put up the smallest concrete version so the tradeoff is easier to evaluate.

Validation

I manually ran:

• docker build -t test-cargo-deny .
• existing list and check Docker invocations with the new empty positional argument
• the rust-toolchain.toml Docker scenario from a temp repo copy
• output-file generation with GITHUB_OUTPUT set, including an assertion for output-file=/output/licenses.txt
• SARIF output capture, checking that the file contains "version": "2.1.0"
• a fork workflow against joshka/cargo-deny-action@joshka/output-file covering SARIF upload and a cargo-deny failure that still writes output-file: https://github.com/joshka/cargo-deny-action/actions/runs/27341236898
• a fork PR workflow showing the SARIF upload is associated with refs/pull/1/merge: Test output-file action PR behavior joshka/cargo-deny-action#1
• a fork PR workflow with a newly introduced cargo-deny alert on a changed line: Test PR code scanning alert display joshka/cargo-deny-action#2
• git diff --check

AI generated the first pass of this change, and I manually reviewed and validated the behavior above.

[joshka]

Example failing output https://github.com/joshka/cargo-deny-action/security/code-scanning/1

[joshka]

PR example of seeing the output directly as a comment in the PR: joshka#3