SA-03: consider a repo-tree filename fallback for projects without Security Insights assessments

[vinayada1]

Context

Follow-up from review of #426 (OSPS-SA-03 implementation).

Both HasSecurityAssessment (SA-03.01) and HasThreatModelAnalysis (SA-03.02) derive their evidence solely from the Security Insights SecurityPosture.Assessments block. A project that has performed a security assessment or threat model but records it as a file in the repo (e.g. security-assessment.md, threat-model.md) rather than in its SI file currently returns Failed.

This is consistent with many existing SI-only steps, but it diverges from the sibling HasDesignDocumentation (SA-01.01) in the same file, which also scans the repository tree (root files + common doc directories) before falling back to SI.

Proposal

Add a cheap root-tree filename fallback to both SA-03 steps, mirroring HasDesignDocumentation:

• SA-03.01: look for root files like security-assessment.md, security-assessment.rst, a security/ or assessments/ directory.
• SA-03.02: look for threat-model.md, threatmodel.md, attack-surface.md, etc.
• On match with no SI declaration, return NeedsReview (consistent with the PR's "declared ≠ sufficient" convention) rather than Failed.

This reduces false Failed results for non-SI projects without weakening the verdict semantics.

Notes

• Non-blocking; the PR is correct as-is for SI-based projects.
• Should reuse the tree-walking pattern already in HasDesignDocumentation.