Carry OSCAL control family + sort POA&M rows by control for eMASS readability

[cognis-digital]

Problem

emit_poam() in stigsentry/core.py emits rows in scan/iteration order and
only includes the control id + resolved title. The feeds.ControlResolver
already knows each control's family and family title (it's in the
_index_catalog output), but that context isn't surfaced in the POA&M.

For an ISSO importing into eMASS/Xacta, two improvements would help:

1. Sort the weakness rows by control id (e.g. AC-3, AC-6, IA-2, IA-5, SC-13)
   so related controls group together — easier to review and to assign POCs.
2. Optionally include a Control Family column (or family title) resolved
   from the OSCAL catalog, since the family is already available offline.

Proposal

• Add an optional group_by_control: bool = False (or sort=True) parameter to
  emit_poam that stable-sorts rows by nist_800_53 then severity.
• Add an optional family column populated from ControlResolver.resolve(cid)["family_title"]
  when enrichment ran (empty otherwise), behind a flag to keep the default CSV
  header stable for existing importers.

Acceptance

• Default emit_poam output is byte-compatible with today (no header change).
• With the new flag, rows are grouped by control and carry the family title.