[Recommendation] discovery scan type for Networks in OSCAL

[brian-ruf]

For "network" components there should be forth scan type: "discovery", which indicates the scan is intended to identify actual assets on the network.

This has always been an implied part of the "infrastructure" scan type; however, that scan type is more about drilling into the nodes for deeper analysis. Discovery is actually a related, yet separate activity.

For networks, only a discovery scan makes sense. Any nodes found on the network are then subject to the infrastructure scan, and other scans as appropriate.

Proposal

Expand the allowed-values for the "scan-type" prop (FedRAMP Extension) to allow "discovery" only for networks. This includes "network" component and any inventory-item either with the "asset-type" prop" set to "network" or the implemented-component` field linked to a network.