Add assessments to OCSF

[jonrau-at-queryai]

Description of changes:

See this thread in the Slack for more information on the backstory.

Adds an assessment object that serves as a generalized Object that can contain normalized assessment/evaluation data of specific configurations or signals in a generalized fashion. For instance, this can be used to capture details for CrowdStrike Zero Trust Assessments of Hosts, to generalize assessment data of CSPM/DSPM platforms such as the various ways to express if logging, encryption, or private access is enabled, and to expand the compliance object for specific technical control assessments.

It is important to separate these from the Findings Category as not every assessment results in a first party alert or detection triggering, for instance the CrowdStrike Zero Trust Assessments are passively conducted on certain hosts with Identity Protection and don't necessarily represent a negative finding.

This also allows for more abstracted asset inventories built upon different sources where generic assessment data and metadata about the asset/entity itself can be centralized without needing to rely on multiple different Event Classes.