docs: asset exposure and deployment context

[devGregA]

Description

Documents the Asset Exposure beta feature in DefectDojo Pro, which records how reachable an asset is from outside and whether a Finding's code is actually deployed in production, and feeds both into the computed priority.

New page: docs/content/triage_findings/finding_scoring/asset_exposure.md, alongside the existing CVSS, EPSS/KEV and Reachability pages in Scoring & Prioritization.

It covers:

• The five normalized exposure verdicts, and how conflicting sources resolve (strongest wins, most recent among equals) so an observation of exposure outranks an assertion of non-exposure.
• Why automated sources may report exposure but may never assert Isolated, while a person may. Several vendors report exposure as a plain true/false field where an absent value and a false value are indistinguishable, so treating a missing field as isolation would quietly bury a live internet-facing system.
• The per-asset exposure override, and how an existing Internet Accessible setting carries into it on upgrade. An unticked checkbox is not converted, because "nobody has said" is not the same statement as "this asset is isolated".
• Deployment context, its two inputs (environment mapping, then the asset's production branch), and the two cases that deliberately resolve to Unknown rather than to "not in production": the Development and Default environments, which a scan lands in automatically when no environment is named, and a test with no branch recorded.
• How both signals adjust priority, that Unknown always scores neutrally, and that every weight is tunable per prioritization engine.
• The optional exposed risk floor and isolated risk ceiling, including that neither closes or hides a Finding and that exploited-in-the-wild evidence always re-raises.
• Using exposure for VDR remediation tiers, which is a separate opt-in from the feature flag because it changes remediation deadlines, and which can only ever tighten a deadline.

Also adds a short cross-reference on the Reachability page. The two features are easy to confuse: reachability asks whether the vulnerable code can be reached inside the application, exposure asks whether the asset can be reached from outside and whether the code is deployed at all.

Documentation only. No code changes.