Add Open Pentest Format (OPF) parser

[Su1ph3r]

Adds a parser for the Open Pentest Format (OPF), a JSON format for pentest
findings (spec: https://cairnsecurity.com/opf). It reads a .opf.json file and
maps each finding to a DefectDojo finding, so an OPF export imports directly with
no conversion step.

Mapping

OPF	DefectDojo Finding
severity	severity (informational becomes Info)
cvssScore / cvssVector	cvssv3_score / cvssv3
first cweIds / cweId	cwe
cveIds	unsaved_vulnerability_ids
recommendation	mitigation
impact	impact
stepsToReproduce	steps_to_reproduce
references	references
URL affectedAssets	endpoints (other assets go in the description)
testType, owaspCategory, mitreTechniques	tags
id	unique_id_from_tool / vuln_id_from_tool

OPF text is sometimes HTML (textFormat: "html"), so the parser flattens it to
plain text.

Included

• dojo/tools/opf/ parser
• Unit test (unittests/tools/test_opf_parser.py) and two sample scans (unittests/scans/opf/)
• Docs page (docs/content/supported_tools/parsers/file/opf.md)
• Dedupe config for the OPF Scan scan type in settings.dist.py

Testing

python manage.py test unittests.tools.test_opf_parser --keepdb covers an empty
document and a four-finding document: severity mapping, CWE, CVSS score and
vector, HTML flattening, tags, and findings that carry no CVSS.

[Su1ph3r]

The two red checks are the Unit Tests Complete gate and one UI test shard (login_test / alerts_test / system_settings_test). That shard failed on relation "dojo_system_settings" does not exist, which looks like a DB/migration setup race in the test container rather than anything from this PR, and the gate just mirrors that single failure.

This change is a file parser that doesn't touch the UI, and the rest-framework unit tests pass, so nothing that exercises the parser is red. Could a maintainer re-run the failed jobs when you have a moment? Happy to rebase or push a change if you'd prefer.

[Su1ph3r]

Correction to my note above: I misread the log. The relation "dojo_system_settings" does not exist line comes from postgres during migration and is not the failure.

The shard actually failed on tests/engagement_extended_test.py::test_close_engagement_for_reopen, a Selenium engagement test that errored on a WebDriver call. The Unit Tests Complete gate is just mirroring that one shard.

The conclusion is unchanged, but the evidence I cited for it was wrong. This PR adds a file parser under dojo/tools/opf/ plus a three-line entry in settings.dist.py, and touches nothing in the engagement UI. The parser unit tests pass.

Happy to rebase onto current master so the shard re-runs, or to make any changes you would prefer.

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[Su1ph3r]

Rebased onto current dev, conflicts resolved. The only conflict was in settings.dist.py, where recent dev added new dedupe entries alongside this PR's OPF Scan entries; I kept both. History is now a single parser commit on top of dev, and the diff is unchanged (7 files, parser + tests + docs). Ready for review whenever a maintainer has a moment.