Add NIST SP 800-53 Mappings to the Baselines

[adhilto]

🗣 Description

Add mappings to the NIST SP 800-53 Rev 5 FedRAMP High baselines. These are shown in two places:

• In the baseline documents themselves
• In a csv file: /PowerShell/ScubaGear/mappings/scuba-to-nist-sp-800-53-r5-fedramp-high.csv

💭 Motivation and context

Closes #940.

🧪 Testing

I ran ScubaGear to verify that the markdown changes didn't break the markdown parser.

✅ Pre-approval checklist

• This PR has an informative and human-readable title.
• PR targets the correct parent branch (e.g., main or release-name) for merge.
• Changes are limited to a single goal - eschew scope creep!
• Changes are sized such that they do not touch excessive number of files.
• All future TODOs are captured in issues, which are referenced in code comments.
• These code changes follow the ScubaGear content style guide.
• Related issues these changes resolve are linked preferably via closing keywords.
• All relevant type-of-change labels added.
• All relevant project fields are set.
• All relevant repo and/or project documentation updated to reflect these changes.
• Unit tests added/updated to cover PowerShell and Rego changes.
• Functional tests added/updated to cover PowerShell and Rego changes.
• All relevant functional tests passed.
• All automated checks (e.g., linting, static analysis, unit/smoke tests) passed.

✅ Pre-merge checklist

• PR passed smoke test check.

• Feature branch has been rebased against changes from parent branch, as needed

  Use Rebase branch button below or use this reference to rebase from the command line.

• Resolved all merge conflicts on branch

• Notified merge coordinator that PR is ready for merge via comment mention

• Demonstrate changes to the team for questions and comments.
  (Note: Only required for issues of size Medium or larger)

✅ Post-merge checklist

• Feature branch deleted after merge to clean up repository.
• Verified that all checks pass on parent branch (e.g., main or release-name) after merge.

[gdasher]

High level question, feel free to follow up on slack if you like: skimming through, it looks like you were able to map most things to 800-53 controls that were in the FedRAMP High baseline. Where there any things you thought were stretches and mapped better to 800-53 controls that weren't in the FedRAMP baseline at all? When I did a super cursory version of this exercise last year I found a number of such cases but I'm curious your take after spending some more quality time with the problem.

[amart241]

Looks exactly like what we had done over the past few weeks. straight forward and good to go.

[ahuynhMITRE]

no issues with the NIST mappings! Good additions with the new mappings.md and mapping.csv to store the context and spreadsheet in GitHub.

[mitchelbaker-cisa]

This PR looks good to go after syncing with main.