Properly target response check for implemented-requirement/statement

[aj-stein-gsa]

Committer Notes

Fix #939.

All Submissions:

• Have you selected the correct base branch per Contributing guidance?
• Have you set "Allow edits and access to secrets by maintainers"?
• Have you checked to ensure there aren't other open Pull Requests for the same update/change?
• Have you squashed any non-relevant commits and commit messages? [instructions]
• Have you added an explanation of what your changes do and why you'd like us to include them? Explained in the issue linked to this pull request.
• If applicable, have all FedRAMP Documents Related to OSCAL Adoption affected by the changes in this issue have been updated.?
• If applicable, does this PR reference the issue it addresses and explain how it addresses the issue?

By submitting a pull request, you are agreeing to provide this contribution under the CC0 1.0 Universal public domain dedication.

[wandmagic]

            <expect id="missing-response-components" target="//statement" test="count(by-component) gt 0" level="ERROR">
                <formal-name>Missing Response Components</formal-name>
                <prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/6-security-controls/#response-overview"/>
                <message>Each implemented requirement MUST have at least one by-component reference to the source component implementing it.</message>
            </expect>

I ended up doing this

[aj-stein-gsa]

I will reopen this PR to point to the #953 branch.