Add support for "Wont fix" retest status

[Synchro]

It doesn't really fit into any of the other categories.

While I was doing this I also added support for using the same "pretty" status names that are used in findings in the summary tables too.

I also cleaned up some of the code a bit as it was hard to read in places – it could do with reformatting properly!

[gronke]

Changes LGTM.

I typically use a won't fix label and leave the re-test status on unresolved. Should risk acceptance not be done by the client internally, not reflect as status? Or is reflecting a vendor response as re-test status intentional?

[Synchro]

I think it's workable for both parties. We could recharacterise it as accepted? I think unresolved doesn't really convey the fact that the matter is closed as far as they are concerned, and it's indistinguishable from something that they have not done anything about, which is what led me to do this.

I know there is some support for labels, but whenever I use them it makes my IDE show lots of XML validity warnings, so I'm not too comfortable with them.

[gronke]

and it's indistinguishable from something that they have not done anything about, which is what led me to do this.

In this case I typically set a won't fix label, which represents the vendor's remark having no intention to fix is. The goal of that label is to signal that, which is important information, but I would rather close a false-positive. Though all cases that come to my mind now are exclusively refusals by a vendor. As a pentester I don't feel entitled to approve risk acceptance, and the recommendation in the finding either stand (or the finding should be closed).

[Synchro]

Fair enough. I set up the commits so the formatting clean up and pretty labels in summary tables should be cherry-pickable, though there might be a little overlap.

[Synchro]

I've changed the status value to accepted_risk in line with comments here and in ROS chat. I think this reflects a slightly less passive-aggressive stance than "won't fix", but also addressing the fact that accepting a finding or otherwise explicitly deciding to do nothing is a fairly common resolution, which is what made unresolved unsatisfactory for me.