Feature: Add issue connectors and EU CRA response workspace

[JustNZ]

Release

Release 2 — VEX and remediation operations

Goal

Connect remediation work to delivery teams and help product manufacturers assemble time-sensitive vulnerability-response evidence.

Scope

• Define an extensible issue-provider interface.
• Ship generic authenticated webhook and Jira-compatible create/update support.
• Use deterministic idempotency keys and retain delivery logs.
• Add product-response cases with awareness time, impacted releases/users, corrective measures, communications, and advisory drafts.
• Show configurable 24-hour and 72-hour clocks and export a structured reporting packet.
• Do not automatically submit reports to authorities.

CRA reference:

• https://eur-lex.europa.eu/eli/reg/2024/2847/2024-11-20/eng

Acceptance criteria

• Re-evaluation does not create duplicate external tickets.
• Ticket state and URL remain linked to the remediation case.
• Connector secrets use existing encrypted-secret patterns.
• Reporting timers use an explicit operator-recorded awareness timestamp.
• Exports clearly state they support evidence preparation and are not a compliance certification.