[WIP] feat(conformance): adds example conformance workflows

[jpower432]

Summary

This is a draft PR is meant to open discussion on how testing the SDK core capabilities across languages could be accomplished.

What is proposed here

Taking a hybrid approach to SDK testing with only the common capabilities being tested centrally (essentially for testing common workflows and verifying outputs) and any unique functionalities being tested in the their respective SDK codebases.

What could be defined here

• An agreed upon spec or set of capabilities
• OSCAL test data
• Common tests for valid OSCAL outputs including testing around constraints

What tools were used for testing

• python, pytest, and GitHub Action (This would be consumed as a composite action in SDK repositories)
• trestle is used as an example for integration testing

Rationale

• This can reduce duplication of the same tests
• Ensure the OSCAL documents processed and produced are uniform for common capabilities
• Enhance collaboration between maintainer teams around the spec and criteria

Caveats

• SDKs would need CLI wrappers to use this solution
• Centralizing the test suite could hinder API development as it initially evolves (perhaps a phased approach where we can the tests after the initial spec is created?)

Additional Information

Triggered by oscal-compass/community#83

[jpower432]

Some specific decisions/questions where I think feedback would be helpful:

1. We agreed that we should specific a common set of functionality for the SDKs here (discussed in the community meeting Oct 8th). We need to choose what format we want to use to describe this, but for now I have used Markdown as an simple example.
2. Should we have common test data here?
3. Should supported OSCAL schemas for the projects be moved here?
4. Should we have a common set of tests for inputs and outputs or should tests be maintained in each repository that contains an SDK?