feat(parsers): add native NIST OSCAL 1.2.3 assessment-results parser

[AAH20]

Summary

Adds a native NIST OSCAL 1.2.3 (Open Security Controls Assessment Language) assessment-results parser under dojo/tools/oscal/.

Problem Solved

While DefectDojo supports dozens of legacy vulnerability formats, enterprise and federal compliance teams require ingestion of machine-readable NIST OSCAL 1.2.3 assessment-results JSON documents (e.g. produced by Prowler, FedRAMP assessment engines, or custom GRC platforms).

This parser:

1. Parses Schema-Valid OSCAL 1.2.3: Ingests assessment-results JSON documents.
2. Observation & Finding Linkage: Correlates evaluated checks/observations with non-compliant control findings.
3. NIST SP 800-53 Mapping: Extracts target resources, control IDs (AC-3, SC-13, IA-2), and check IDs.
4. Status & Mitigation Mapping: Automatically flags failing controls as active and passing/satisfied controls as mitigated.

Testing & Validation

• Added unittests/tools/test_oscal_parser.py covering failing findings, passing/mitigated findings, empty payloads, and scan type registration.
• Verified all unit tests pass cleanly.

Upstream & Commercial Context

Maintained by A2Z SOC for enterprise vulnerability management, continuous trust, and FedRAMP / SOC 2 audit readiness.

For organizations requiring automated OSCAL compliance pipelines or GRC readiness sprints:

• Instant Audit ($499): https://a2zsoc.com/productized-services#instant-audit-tripwire
• Consultation & AppSec Sprints: https://a2zsoc.com/consultation

[AAH20]

Fixed the CI failure — ruff-linting was failing, which blocked every downstream test job (Unit Tests Complete failed purely as a consequence; the real test suites never ran).

Fixed all 13 flagged style violations (11 via ruff --fix, 2 applied manually after review).

While reviewing those two manual fixes, I found a real bug beyond lint: target_status = target.get("status", "") assumed status is always a string, then called .lower() on it. But the OSCAL 1.2.3 schema defines finding.target.status as a required object — {"state": "satisfied"|"not-satisfied", "reason": "pass"|"fail"|"other"} — not a string.

I proved this is a live break, not theoretical: I fed this parser the actual output of a just-fixed OSCAL exporter (prowler-cloud/prowler#12475, which now correctly emits the object-shaped status per the same schema), and it crashed with AttributeError: 'dict' object has no attribute 'lower'. Any schema-compliant OSCAL producer would fail to import here.

Added _is_failed(), which handles both shapes: the correct object shape (checking state/reason), a bare string (matching this repo's existing test fixtures, for looser producers), and target.status being absent entirely (falls back to the finding-level status prop).

Re-ran the exact prowler-output-crashes-this-parser reproduction after the fix — now parses successfully. Added 3 regression tests alongside the 4 existing ones (7/7 passing). ruff clean.