docs: Baseline assessment results in OCSF Compliance Findings

[trumant]

The purpose of this PR is to document a means by which Baseline assessment evidence can use the OCSF schema for interchange purposes between tools.

Desired feedback from reviewers

1. Does OCSF seem like a useful schema for this purpose?
2. Which optional and recommended fields provide the most value to someone consuming the results of a baseline assessment?
3. Are there OCSF-compatible tools that would get value from assessment data in this format?

[trumant]

This is a companion to https://docs.google.com/document/d/16zwe3eNwExvnaXLDUrkGNineZzB0r8arKE3G-cvNU0E/edit?tab=t.0

[funnelfiasco]

Admittedly, I've not given the Google doc more than a quick glance, but it's not clear to me what the purpose of this PR is or why it belongs here and not in the Baseline repo (perhaps the former answers the latter).

[trumant]

Admittedly, I've not given the Google doc more than a quick glance, but it's not clear to me what the purpose of this PR is or why it belongs here and not in the Baseline repo (perhaps the former answers the latter).

I raised the PR here as the topic of data interchange is core to the WG, but the particular material I'm commenting on didn't seem like it fit neatly as a contribution to ossf/security-baseline and had broader applicability to the WG as a whole, rather than to a single project.

[funnelfiasco]

So is the intent to define this as the mechanism for data interchange or to note is as one possibility?

Since there's no docs/ directory yet (or other organization for the WG repo), it's not entirely clear what the intent is here.

[trumant]

So is the intent to define this as the mechanism for data interchange or to note is as one possibility?

Since there's no docs/ directory yet (or other organization for the WG repo), it's not entirely clear what the intent is here.

I'm noting the possibility and looking for feedback on utility/suitability of this being one such expression of the results of a baseline assessment.

[eddie-knight]

Let's talk through this on the WG call — putting an X on it so it doesn't get merged early