Fix: Store rule severity in messages, rather than pulling from the config on-demand

Fixes #984.

This stores the rule severity on the message objects created when a rule generates a report. This ensures that the severity is always what the rule gets at that instant, regardless of anything that's affected the config up to that point. It also removes all dependency on the config from the formatters, they now depend only on the messages.
That might be true now, however, there are custom formatters out there in the wild that will break if we just remove it. We need to do a removal in two steps: first we deprecate its usage and then we actually remove it.