Provide prose explaining the use of guids across all occurrences

[sthagen]

During the TC meeting 2024-07-11 the discussion made explicit, that the use cases for the diverse guid elements require a clear guidance in the prose.

As example it should be made clear what consequences are expected if for two or more SARIF files targeting the same analysis target, the corresponding guid fields (root object or else):

• share the same value
• have different values

[sthagen]

Proposal to foster consensus on the semantics of guid's as root level member:

---

The same guid value on the root elements of two or more SARIF files
indicates that the information content MUST be the same.

Hashing of text based formats is ambiguous for duplicate detection as the line
ending conventions differ and impact the hash.

Examples of possible duplication sources are: File copies, stored byte streams

Differing guid values on the root elements of two or more SARIF files
indicate that the files are different.

Examples are reports from different nodes on the same system under test using
identical tools or a retest run.

---