feat(prowler): CHK.005 OCSF Mapping

[Kakudou]

Goal

Provide a consistent OCSF finding mapping to OpenAevFinding, including result status,
severity, and compliance handling.
Even if we send raw OCSF back to OpenAEV, having a clean parser will be handfull for intenal usage.

PR Target

Prowler injector: OCSF finding mapping and severity normalization.

Acceptance Criteria

Feature: OCSF finding mapping and severity normalization

  Scenario: Map all declared finding fields
    Given an OCSF finding with finding, resource, cloud, remediation, and compliance data
    When the finding is mapped to OpenAevFinding
    Then the result contains exactly the 14 declared fields
    And each field contains its documented source value or transformation

  Scenario Outline: Normalize status
    Given an OCSF finding with status "<source_status>"
    When the finding is mapped to OpenAevFinding
    Then expectation_result is "<result_status>"

    Examples:
      | source_status | result_status |
      | PASS          | SUCCESS       |
      | PASSED        | SUCCESS       |
      | FAIL          | FAILED        |
      | FAILED        | FAILED        |
      | MUTED         | IGNORED       |
      | MANUAL        | IGNORED       |
      | SUPPRESSED    | IGNORED       |
      | ERROR         | MUTED         |
      | UNKNOWN       | MUTED         |

  Scenario Outline: Normalize severity
    Given an OCSF finding with severity "<source_severity>"
    When the finding is mapped to OpenAevFinding
    Then severity is "<normalized_severity>"
    And severity_weight is <weight>

    Examples:
      | source_severity | normalized_severity | weight |
      | critical        | CRITICAL            | 4      |
      | high            | HIGH                | 3      |
      | medium          | MEDIUM              | 2      |
      | low             | LOW                 | 1      |
      | informational   | INFO                | 0      |
      | unknown         | INFO                | 0      |

  Scenario: Normalize a missing severity
    Given an OCSF finding without a severity value
    When the finding is mapped to OpenAevFinding
    Then severity is "INFO"
    And severity_weight is 0

  Scenario: Handle missing compliance data
    Given an OCSF finding without compliance data
    When the finding is mapped to OpenAevFinding
    Then compliance_tags is an empty collection

Done Checklist

• All 14 declared OpenAevFinding fields are mapped.
• Status normalization satisfies the acceptance criteria.
• Severity normalization satisfies the acceptance criteria.
• Compliance handling satisfies the acceptance criteria.

[Kakudou]

Close, too much sub-issue is counterproductive, leave solely in PR.