feat!: establish mapping boundary between inline and document

[jpower432]

Description

Adds initial mapping PR for discussion

EDITED
Summary of discussion in #306 regarding how to handle gap analysis:

• Controls at Layer 2 are self-contained; extending or importing a catalog preserves all existing technical mappings.
• Transitive relationships (A-to-C) are maintained and "flattened" when imported into a Layer 3 Policy.
• The Gemara schema should remain declarative; gaps should be a calculated outcome during OSCAL conversion (to be validated)
• A use case: Consuming systems system could flag missing coverage as Risk candidates for audit teams to investigate in the Audit Layer.
• Determine how to populate source-gap-summary and target-gap-summary to align with the OSCAL mapping-collection model.
• Detemine a way to quickly detect omitted controls without parsing every individual mapping.
• Explore how mappings "tighten" or change when a control is tailored for a specific "profile" or technical implementation.

Schema Changes

Schema Changes Made

• No schema changes
• Layer 1 schema (layer-1.cue) changes
• Layer 2 schema (layer-2.cue) changes
• Layer 3 schema (layer-3.cue) changes
• Layer 5 schema (layer-5.cue) changes

Schema Change Details

<!-- If applicable, provide a brief summary or example of schema changes -->

Testing

• Unit tests added/updated
• Manual testing performed
• Test data updated (if applicable)

Related Issues

Closes #304
Closes #86 (?)
Blocked by #312
Continues discussion of #306

Reviewer Hints

Self-review checklist

• This PR has content that was created with AI assistance.
  • I have read and followed the Generative AI Contribution Policy.
• I have the experience and knowledge necessary to answer maintainer questions about the content of this PR, without using AI.

---

[jpower432]

@eddie-knight I am wondering if we need to review whether these mapping structures can support - ossf/scorecard#4952 (comment)

[jpower432]

Doing a quick prototyping check in go-gemara to see how this maps to the Control Mapping Model in gemaraconv before merging this

[jpower432]

@eddie-knight I think this is actually ready for review now. The last fixes were made to ensure the generated Go types are what we expected.