As tech lead, I need "low" findings from WebInspect Oct 2022 scan addressed

[ADPennington]

Description:
ACF OCIO performs monthly security scans on prod using WebInspect, and has a few low findings for Oct 2022:

More information is on p. 8+ here 🔒

Acceptance Criteria:

• source of issue identified
• source of issue resolved or documented
• Testing Checklist has been run and all tests pass
• README is updated, if necessary

Tasks:

• investigate root cause
• look into why this isnt showing up in owasp scans
• resolve/document
• Run Testing Checklist and confirm all tests pass

[ADPennington]

11/15 update:

• @n0remac will remove robots via PR
• @ADPennington will draw up notes for @tdrammeh1 @AiseosaO to review for remainder of low findings that do not need remediation.
• we will re-work ADR#16 to track security scan waivers

cc: @stevenino

[ADPennington]

per discussion with OCIO on 1/10/2023:

• robots file can be removed
• webinspect results that are due to scan parameter limitations (e.g. java not enabled) can be ignored in future scan reports.
• results that return a 403 forbidden should be rerouted to 404. we can spin up new tix for this if needed. seems relatively low in priority.
• alex will capture false positives in ATO doc.

cc: @andrew-jameson @stevenino