feat(lab10): defectdojo governance report + capstone walkthrough

[alileeeek]

Goal

Lab 10 capstone submission: DefectDojo setup with imports from Labs 4-7, SLA matrix applied, governance report with program metrics, and 5-minute interview walkthrough script.

Changes

• Added submissions/lab10.md with governance report (imports table, dedup example, severity/tool breakdown, metrics, risk-accepted items, next-quarter SAMM goal).
• Added submissions/lab10-walkthrough.md with timed 5-minute interview script + Q&A anticipation.

Testing

• DefectDojo running locally at http://localhost:8081 (admin access verified).
• Product "OWASP Juice Shop" + Engagement "Course Run" created via API.
• 8 scan types imported from Labs 4-7 (Trivy, Grype, Checkov, KICS).
• Total findings: 364 (17 Critical, 153 High, 158 Medium, 27 Low, 9 Info).
• Deduplication example: NSWG-ECO-17 Jsonwebtoken 0.4.0 found in both Trivy Lab 4 and Trivy Lab 7.
• SLA matrix applied (24h/7d/30d/90d for Critical/High/Medium/Low).
• Walkthrough script timed to 5 minutes.

Artifacts

• DefectDojo instance running locally (not committed — ephemeral).
• All governance metrics and walkthrough script in submissions/.

---

Task Checklist

• Task 1 — DefectDojo setup + imports + dedup proof
• Task 2 — Governance report with MTTD/MTTR/SLA/backlog
• Bonus — 5-minute walkthrough script with timed practice