feat: add NIST OSCAL 1.2.3 assessment-results output format

[AAH20]

What

Adds oscal.json as a new export/output format, alongside the existing csv, html, json, md, nunit3.xml, asff.json.

Why

Powerpipe's export formats don't include OSCAL (confirmed by code search — zero references to "oscal" anywhere in the repo). OSCAL 1.2.3 is the NIST-standard machine-readable assessment-results format; Prowler, DefectDojo, and IBM's compliance-trestle all already support it. Powerpipe is the most broadly-used open compliance-as-code tool across the providers it supports (AWS, GCP, Azure, GitHub, and more), so this closes a real, verified gap rather than a guessed one.

How

Follows the exact existing pattern for adding a format: a new internal/controldisplay/templates/oscal.json/ directory (output.tmpl + version.json), matching how asff.json maps control results into another external standardized schema. No registry changes needed — formats are auto-discovered from the templates directory.

Mapping from Powerpipe's five control-row statuses to OSCAL:

• Every row becomes an Observation (uuid, description, methods, collected — all schema-required, all present).
• Only "alarm" (failed) rows also become a Finding. "error"/"skip"/"info" are inconclusive, not failures — matching the same honesty rule used in prowler#12475's OSCAL exporter, they're never asserted satisfied/not-satisfied, Observation only.
• finding.target uses type: "objective-id" and target-id = the control's FullName (a dotted Powerpipe control name satisfies the OSCAL TokenDatatype pattern; a raw uuid would not).
• observations/findings are omitted entirely when empty rather than emitted as [], since both have schema minItems: 1.

One small Go change: added "uuidv4" to the sprig function whitelist in template_functions.go — OSCAL requires real uuid fields the existing whitelist had no way to produce.

Verification

Downloaded the real, official OSCAL 1.2.3 schema from the usnistgov/OSCAL v1.2.3 release (not assumed). Added formatter_oscal_test.go, which renders the template through the actual TemplateFormatter.Format() code path — real Go structs (ExecutionTree/ControlRun/ResultRow), no HCL parsing needed since ControlRun exposes FullName/Title/Description/Severity directly — against two hand-built trees: one mixed ok+alarm, one all-ok. Both render successfully and validate with zero errors against the official schema; the all-ok case specifically confirms "findings" is genuinely absent, not [].

gofmt clean, go vet clean, full internal/controldisplay package test suite passes.

Test plan

• go test ./internal/controldisplay/... — all pass
• Rendered output validated against the official NIST OSCAL 1.2.3 JSON schema (0 errors, both mixed and all-ok cases)
• gofmt -l / go vet clean

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
2 out of 5 committers have signed the CLA.

✅ pskrbasu
✅ kaidaguerre
❌ cbruno10
❌ graza-io
❌ AAH20
_{You have signed the CLA already but the status is still pending? Let us recheck it.}