nessus: parse more fields

[valentijnscholten]

Users reported on Slack that the Nessus CSV report can contain fields that are currently not parsed by DefectDojo:

Reference: https://owasp.slack.com/archives/C2P5BA8MN/p1743609798217049

This PR parses some more fields in the csv parse:

• epss_score
• more references
• vpr score
• stig score
• canvas
• metasploit exploitable
• core impact
• canvas
• plugin information

To me it's not clear what some of these fields, but probably anyone using Nessus will understand. So it's good to have these values in the description, references or severity_justification field.

We decided for now not to parse the CWE field that is present in the XREF fields as it would influence the hash code calculation which we would not be able to get aligned with older findings that did not have the cwe field parsed and stored.

Ruff required me to update all test cases.

[dryrunsecurity]

This pull request involves potential information exposure in reference expansion, modifications to EPSS score processing, and the presence of multiple vulnerabilities in a Nessus scan template, which could impact system security and data handling.

💭 Unconfirmed Findings (3)

Vulnerability	Potential Information Exposure in References Expansion
Description	Located in dojo/tools/tenable/csv_format.py, this finding involves adding multiple new reference sources that could expose additional system or vulnerability metadata, potentially increasing the risk of sensitive information disclosure.

Vulnerability	EPSS Score Processing Modification
Description	Found in dojo/tools/tenable/csv_format.py, this modification introduces logic for handling EPSS scores that might cause unexpected behavior, particularly in transforming scores without decimal points which could lead to inconsistent processing.

Vulnerability	Multiple Vulnerabilities in Nessus Scan Template
Description	Identified in unittests/scans/tenable/nessus/nessus-template.csv, this finding includes several specific vulnerabilities: SSL Medium Strength Cipher Suites (SWEET32), HTTP TRACE/TRACK Methods Enabled, SSH Terrapin Prefix Truncation Weakness, Multiple PHP Vulnerabilities, and Kibana Osquery Pack Availability Exploit.

---

All finding details can be found in the DryRun Security Dashboard.

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[mtesauro]

Approved