A target is simply something that the compiler produces. Looking at the Clang C++20 modules documentation, that appears to be specified using -o <name>.pcm, making it no different to producing an object file.
Another problem with hashes is that they will lead to old diagnostic files hanging around when new flags are added to builds. Suppose upgrading from Clang 18 introduces a warning that’s particularly noisy for a single test file, so I add -Wno-noisy-warning to my build file. That means that the previous invocation won’t be overwritten with the new diagnostics, and now the SARIF consumer will be loading diagnostics for the same invocation twice, and one of them will be a set of outdated false positives.