Add automation script to export security control annotations into a set of bidirectional code-control, services-control mappings - for compliance - example: ComputeFirewallPolicy maps to AC-3(9), AC-4...

see https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/issues/151

expanding...
see for example ComputeFirewallPolicy mapping to AC-3(9)...

https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/blob/main/solutions/client-landing-zone/client-folder/firewall-policy/policy.yaml#L22

```
# Client Compute Firewall Policy to folder client-folder
# AC-3(9), AC-4, AC-4(21), SC-7(5), SC-7(8), SC-7(9), SC-7(11) - All connections to or from virtual machine instances are allowed/denied via firewall rules configured in shared VPC network within host project or firewall policies in parent folders based on least-privilege principle. Each firewall rule applies to incoming(ingress) or outgoing(egress) connections, not both.
apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeFirewallPolicy
```

and annotation based - thanks Dave
https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/blob/dde8eb702b65b0a72866685529f42b3512897f68/solutions/guardrails-policies/09-network-security-services/template.yaml#L22

```
kind: ConstraintTemplate
metadata:
name: limitegresstraffic
annotations:
description: Establish external and internal network perimeters and monitor network traffic.
reference: https://github.com/canada-ca/cloud-guardrails/blob/master/EN/09_Network-Security-Services.md
related-security-controls: AC-3, AC‑4, SC-5, SC‑7, SC‑7(5), SI-3, SI-3(7), SI-4
```

TODO: Dynamic version - integration as a KRM resource that keys off KCC/K8S deployment changes
TODO: offline version - parse the code/annotations using a yaml parser
TODO: online hosted version - d3js.org based or mermaid in-line-repo markup (generated) in https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/wiki/Security_Controls
- https://observablehq.com/@kerryrodden/sequences-sunburst
- https://d3js.org/
- https://github.com/GoogleCloudPlatform/pbmm-on-gcp-onboarding/blob/main/docs/google-cloud-security-controls.md#controls-coverage
- https://mermaid.js.org/#/flowchart?id=graph