Compensating Controls and Compensating Controls Catalog with residual risk score

### Current Behavior:
Comments can be added to each vulnerability of a product, but using comments to track compensating controls is not useful to see the list of vulnerabilities without adequate compensating controls.

### Proposed Behavior:
Is your feature request related to a problem? Please describe.
As a medical device developer, I track the vulnerabilities in several versions of released software. This software is not easily updated due to the need to verify its safe operation for every change, including cybersecurity patching. While DependencyTrack is great at listing the vulnerabilities in a specific software version, it would be very nice to be able to attach compensating controls to a vulnerability.

Describe the solution you'd like
The compensating controls should be stored in a database table (compensating controls catalog), which can be referenced by each vulnerability for a product. The compensating controls in the catalog should have a field to enter a reference to external system requirements (a list text field). The compensating controls GUI page should a list of links to all the vulnerabilities and software products using the control.

Each identified vulnerability for a software product would have a list of compensating controls selected from the compensating controls catalog.

An additional field to add is the residual risk (score) after the compensating controls for a vulnerability. Eventually it would be nice to be able to enter scores for each of the risk components in CVSS3 and have the overall risk automatically computed.

Describe alternatives you've considered
I am currently using text files for each vulnerability with an analysis of the issue and the associated compensating controls. This is a very poor solution as the compensating controls are not shared and it is not easily managed.
I have also used spread sheets, which provided a common set of compensating controls to attach to each vulnerability.