introduce user sensitivity level constraint + refactor

[wandmagic]

Committer Notes

{Please provide a description of what this PR accomplishes. Be sure to reference any issues addressed. If the PR is a work-in-progress submitted for early review, please submit the PR as a draft PR using the "Draft pull request" dropdown.}

All Submissions:

• Have you selected the correct base branch per Contributing guidance?
• Have you set "Allow edits and access to secrets by maintainers"?
• Have you checked to ensure there aren't other open Pull Requests for the same update/change?
• Have you squashed any non-relevant commits and commit messages? [instructions]
• Have you added an explanation of what your changes do and why you'd like us to include them?
• If applicable, have all FedRAMP Documents Related to OSCAL Adoption affected by the changes in this issue have been updated.?
• If applicable, does this PR reference the issue it addresses and explain how it addresses the issue?

By submitting a pull request, you are agreeing to provide this contribution under the CC0 1.0 Universal public domain dedication.

[aj-stein-gsa]

Hey this is good stuff, can you move this into the CONTRIBUTING.md document? There may be stuff there from me, but it could be better. I would appreciate integrating it in this PR, just move it there.

(Inside baseball for you and the FedRAMP Auto Team: long-term I want this particular README to go away after the minor deprecation release.)

[aj-stein-gsa]

Blocking: while working on docs, we diverge from upstream core OSCAL constraints. I am not sure this is a critical issue, I would like to discuss with the team and internal staff if we need to diverge or align with upstream or not.

[aj-stein-gsa]

Blocking: while working on docs, I realized this is a FedRAMP-specific constraint, this does not exist in core upstream OSCAL.

Suggested change

	<allowed-values id="user-sensitivity-level" target="prop[@name='sensitivity']/@value" allow-other="no" level="ERROR">
	<formal-name>User Sensitvity Level</formal-name>
	<description>Sensitivity level of the user.</description>
	<enum value="high-risk">High Risk</enum>
	<enum value="severe">Severe</enum>
	<enum value="moderate">Moderate</enum>
	<enum value="limited">Limited</enum>
	<enum value="not-applicable">Not Applicable</enum>
	</allowed-values>
	<allowed-values id="user-sensitivity-level" target="prop[@ns='https://fedramp.gov/ns/oscal' and @name='sensitivity']/@value" allow-other="no" level="ERROR">
	<formal-name>User Sensitvity Level</formal-name>
	<description>Sensitivity level of the user.</description>
	<enum value="high-risk">High Risk</enum>
	<enum value="severe">Severe</enum>
	<enum value="moderate">Moderate</enum>
	<enum value="limited">Limited</enum>
	<enum value="not-applicable">Not Applicable</enum>
	</allowed-values>

[aj-stein-gsa]

Hi @wandmagic, I rebased this to take a look where are at.

Can you split out the INVALID tests to individual fixture data files for negative tests per ADR 8 and then request re-review? Thanks.

[wandmagic]

closing this, just going to make a new branch