CKV2_AWS_38/39 produce empty helpUri in sarif output

[ankon]

Describe the issue

We're producing sarif output from checkov in a github action. This started failing now because the sarif contains helpUri: null fields, which aren't valid (https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317848).

I can reproduce this locally with checkov 2.1.216, and in my case it's the rules CKV2_AWS_38 and CKV2_AWS_39 with invalid content:

Additional context

Possibly caused by: #3492 adding helpUri
A similar issue existed in cfn-lint, where the fix was to ensure that helpUri is pointing to something sane in all cases: aws-cloudformation/cfn-lint#2276

Workaround

We filter the content before uploading now:

      - name: "Band-aid: Remove empty helpUri in sarif"
        run: jq 'del(.runs[].tool.driver.rules[].helpUri|select(.=="" or .==null))' <results.sarif >results-fixed.sarif

      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: results-fixed.sarif