Add comprehensive security tests for OWASP A02, A05, A07, and A08 categories

- Implemented tests for Cryptographic Failures (A02) to ensure proper handling of sensitive data, secure algorithms, and key management.
- Added tests for Security Misconfiguration (A05) to validate production configurations, security headers, CORS settings, and feature management.
- Developed tests for Authentication Failures (A07) to enforce strong password policies, rate limiting, session management, and MFA support.
- Created tests for Software and Data Integrity Failures (A08) to verify artifact signatures, SBOM integrity, attestation chains, and feed updates.

docs/schemas/proofspine-predicate.schema.json

@@ -0,0 +1,52 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://stella-ops.org/schemas/proofspine.stella/v1.json",
+  "title": "Proof Spine Predicate Schema",
+  "description": "Schema for proofspine.stella/v1 predicate type - merkle-aggregated proof bundle",
+  "type": "object",
+  "required": [
+    "sbomEntryId",
+    "evidenceIds",
+    "reasoningId",
+    "vexVerdictId",
+    "policyVersion",
+    "proofBundleId"
+  ],
+  "properties": {
+    "sbomEntryId": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}:pkg:.+",
+      "description": "The SBOM entry ID this proof spine covers"
+    },
+    "evidenceIds": {
+      "type": "array",
+      "items": {
+        "type": "string",
+        "pattern": "^sha256:[a-f0-9]{64}$"
+      },
+      "minItems": 1,
+      "description": "Sorted list of evidence IDs included in this proof bundle"
+    },
+    "reasoningId": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$",
+      "description": "The reasoning ID linking evidence to verdict"
+    },
+    "vexVerdictId": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$",
+      "description": "The VEX verdict ID for this entry"
+    },
+    "policyVersion": {
+      "type": "string",
+      "pattern": "^v[0-9]+\\.[0-9]+\\.[0-9]+$",
+      "description": "Version of the policy used"
+    },
+    "proofBundleId": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$",
+      "description": "Content-addressed ID of this proof bundle (merkle root)"
+    }
+  },
+  "additionalProperties": false
+}