docs(exposure): name every exposure source and document the CMDB criticality sync

[blakeaowens]

Description

Brings the Asset Exposure documentation and the pages around it in line with what DefectDojo Pro does today.

Asset Exposure (triage_findings/finding_scoring/asset_exposure.md)

• New "Exposure sources" table naming every source that reports exposure verdicts, what each one reports and its confidence: the Wiz, CrowdStrike Falcon, Shodan and Censys connectors, the reachability probe, Universal Parser imports that map the Asset exposure field, and the exposure API.
• New "Submitting verdicts through the API" section documenting POST /api/v2/exposure/verdicts/: the request shape, the accepted verdicts (no isolation from automated sources), the evidence fields and the required permission.

Connector pages

• Shodan, Censys and CrowdStrike Falcon each gain an Asset Exposure section, matching the existing one on the Wiz page. The CrowdStrike section explains why Spotlight's No and Pending answers record nothing, and which API scope the assessment needs.
• ServiceNow CMDB gains a Business Criticality section: how CI business criticality maps onto Asset Criticality, that a value set by a person is never overwritten, and that an unmapped value is skipped. The Priority page links to it from the Criticality field.

Corrections to pages that had fallen behind

• Asset Hierarchy lists the deploys_to relationship (four default relationship types, not three) and explains that it carries exposure and does not roll Findings up.
• Working with SBOMs and Locations Overview no longer describe container image and cloud resource Locations as future types.
• API v3 (alpha) no longer says Locations are URL-only: the list returns every Location type, with the URL detail fields filled in for URL Locations only.

Past release notes are left unchanged.

Test results

Docs only. Every internal link added resolves to an existing page and heading anchor. English pages only; translated copies are generated separately.

Checklist

• Make sure to rebase your PR against the very latest dev.
• Your code is flake8 compliant (no code changes).
• Your code is python 3.13 compliant (no code changes).
• Add applicable tests to the unit tests (no code changes).
• Add the proper label to categorize your PR.

🤖 Generated with Claude Code