Map unknown STIG IDs to a control via CCI before bucketing them as SS-UNK

[cognis-digital]

Problem

When a STIG ID is not in STIG_CONTROLS, scan() emits an SS-UNK-* finding
with nist_800_53="" — the finding is tracked (good, see the recent hardening),
but it carries no control mapping, so it shows up as a (none) control row in
the POA&M and can't be rolled up by control family.

However, many SCAP exports include the CCI-* identifier on the rule even when
we don't recognize the STIG V- id. DISA publishes U_CCI_List.xml, which maps
every CCI to its NIST 800-53 control. We could recover the control mapping from
the CCI alone.

Proposal

1. If a finding row carries a cci field (or the benchmark provides one) and the
   STIG ID is unknown, look the CCI up in a bundled/cached CCI→800-53 index and
   populate nist_800_53 from there.
2. Keep the SS-UNK-* id (still flags "not in our crosswalk") but stop losing
   the control mapping — the POA&M row then carries a real control + title.

Acceptance

• A finding with an unknown STIG ID but a known CCI resolves to the correct
  800-53 control and shows up under the right family in the rollup.
• No CCI / unknown CCI → current (none) behavior is unchanged.