feat(pqc): add CBOM endpoint, quantum risk scoring, NCSC and ENISA fr…

[Vishnu2707]

What does this PR do?

Expands OpenShield's post-quantum cryptography capabilities to world-class level.
Adds structured CBOM output, quantum risk scoring per asset, NCSC UK and ENISA
framework mappings, Harvest Now Decrypt Later exposure analysis, and a
three-phase migration roadmap API.

Type of change

• New scan rule
• API endpoint
• Compliance mapping
• Documentation

What's included

Quantum Risk Scoring

• Each PQC finding now includes a quantum risk score 1-10
• Scores based on algorithm type, internet exposure, and HNDL risk
• Migration priority HIGH/MEDIUM/LOW per asset
• Recommended target algorithm from NIST FIPS 203/204/205

CBOM API Endpoints

• GET /api/cbom - full Cryptographic Bill of Materials from latest scan
• GET /api/cbom/summary - summary and top 5 highest risk assets
• GET /api/cbom/migration-roadmap - three phase migration plan

New Compliance Frameworks

• NCSC UK Post-Quantum Cryptography Migration Guidance
• ENISA Post-Quantum Cryptography Recommendations
• Both mapped to AZ-PQC-001, AZ-PQC-002, AZ-PQC-003

RAG Skill Update

• NCSC and ENISA guidance added to PQC knowledge skill
• HNDL risk assessment section
• CBOM schema documentation

Testing

• 25 focused tests passed
• CBOM route contract checks passed
• All six compliance JSON files validated
• ruff check and ruff format passed
• No hardcoded credentials or secrets
• No AI or co-author traces

Why this matters

OpenShield is now the only free Azure security tool that:

• Generates a structured CBOM for Azure cryptographic assets
• Calculates per-asset quantum risk scores
• Maps findings to NIST, NCSC UK, and ENISA PQC guidance simultaneously
• Provides a prioritised migration roadmap via API
• Surfaces Harvest Now Decrypt Later exposure risk

Closes #[add issue number]

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.