feat(lab10): defectdojo governance report + capstone walkthrough

[SSSNeka]

Goal

Stand up DefectDojo locally, import every scan report from Labs 4–9 into a single Product/Engagement, apply the SLA matrix from Lecture 9/10, and produce a governance report with real program metrics (severity distribution, dedup proof, MTTR/vuln-age/SLA compliance).

Changes

• Added submissions/lab10.md — Task 1 (DefectDojo setup + import log + dedup example) and Task 2 (6-section governance report: exec summary, severity breakdown, findings-by-tool, program metrics, risk-accepted items, next-quarter SAMM goal).
• Regenerated labs/lab7/results/trivy-k8s.json (missing from prior state — the local Docker-Desktop K8s cluster from Lab 7 was still live, so re-ran trivy k8s against it directly).
• No source files were modified — labs/lab10/work/dd/ (upstream DefectDojo clone) is untracked and gitignored, not committed.

Testing

• DefectDojo 3.1.0 deployed via official docker compose dev stack; 8 of 9 planned scan reports imported successfully (Anchore Grype, Trivy Scan ×3, Semgrep JSON Report, Checkov Scan, KICS Scan ×2) — 437 raw findings, 389 active after dedup.
• SLA matrix applied (Critical 1d/24h, High 7d, Medium 30d, Low 90d) via PATCH /api/v2/sla_configurations/1/; verified against a live finding's sla_expiration_date.
• Confirmed cross-scan dedup fires (48 duplicates, all between the two Trivy image scans of the same tag) and documented that it does not fire across tools (Grype vs Trivy) with default settings.
• ZAP import attempted exactly as documented (auth-report.json → ZAP Scan) and failed with a parser format error (XML-only in this DefectDojo version); documented rather than silently skipped. Acceptance criteria (≥6 scan types) met without it.

Artifacts & Screenshots

See submissions/lab10.md for the full import table, dedup example (CVE-2023-46233), severity/tool breakdowns, and SLA/metrics tables.

Checklist

• Title is clear (feat(lab10): <topic> style)
• No secrets/large temp files committed
• Submission file at submissions/lab10.md exists

- [x] Task 1 — DefectDojo setup + imports + dedup proof
- [x] Task 2 — Governance report with MTTD/MTTR/SLA/backlog
- [ ] Bonus — 5-minute walkthrough script with timed practice