Fix: Store rule severity in messages, rather than pulling from the config on-demand

Fixes #984.

This stores the rule severity on the message objects created when a rule generates a report. This ensures that the severity is always what the rule gets at that instant, regardless of anything that's affected the config up to that point. It also removes all dependency on the config from the formatters, they now depend only on the messages.
Got it. Added 'config' parameter back. What's your procedure for deprecations, anything I should add for that or will it just go in the changelog? Should this be "Breaking: " instead of "Fix: "?