Add a `working-directory` option to the upload-sarif action

[crenshaw-dev]

I have a workflow which has to check out the repo to a specific (non-default) directory.

The upload-sarif action produces this error:

fatal: not a git repository (or any of the parent directories): .git
Failed to call git to get current commit. Continuing with data from environment or input: Error: The process '/usr/bin/git' failed with exit code 128
Error: The process '/usr/bin/git' failed with exit code 128
    at ExecState._setResult (/home/runner/work/_actions/github/codeql-action/v2/node_modules/@actions/exec/lib/toolrunner.js:592:25)
    at ExecState.CheckComplete (/home/runner/work/_actions/github/codeql-action/v2/node_modules/@actions/exec/lib/toolrunner.js:575:18)
    at ChildProcess.<anonymous> (/home/runner/work/_actions/github/codeql-action/v2/node_modules/@actions/exec/lib/toolrunner.js:469:27)
    at ChildProcess.emit (node:events:390:28)
    at maybeClose (node:internal/child_process:1064:16)
    at Socket.<anonymous> (node:internal/child_process:450:11)
    at Socket.emit (node:events:390:[28](https://github.com/argoproj/argo-cd/runs/7634411066?check_suite_focus=true#step:5:29))
    at Pipe.<anonymous> (node:net:687:12)

I believe the action expects the working directory to be a git repo.

[aibaars]

Did the upload action actually fail? The phrase Continuing with data from environment or input: suggests that is should carry on regardless.

[crenshaw-dev]

It did not fail. Maybe the appropriate fix is to change the error message? It's really unclear based on the current message whether I should be concerned, i.e. why it would want to be run in a git repo.

[hmakholm]

Since there's a fallback with a fairly good chance of working (namely falling back to the environment variable set by the Actions runner), the message arguably at least shouldn't be presented with a stack trace -- that makes it look more alarming than it ought to.

[aeisenberg]

I changed the issue title to better reflect the actual problem.