docs(pci): document PCI DSS scan and ASV evidence - #16006

Documents the PCI DSS Requirement 11 scan and ASV evidence features, as a companion to the existing PCI DSS scope page.

The page covers:

• How a test gets a PCI role, and that the defaults only fill a role nobody has set.
• The facts a scan report cannot carry: whether the scan was authenticated, the ASV result with its vendor and attestation reference, the significant change a scan answers, and a note.
• Significant changes and unauthenticated system exceptions, including that an exception reads as needing attention rather than as satisfied.
• What each cell of the quarterly grid means, with the exact rule behind it in a table, and that quarters are counted from the assessment anchor date rather than from 1 January.
• How the annual Requirement 11.4 checks are measured, including the six-month segmentation cadence for a service provider.
• The dashboard tile and the end-of-quarter reminders.
• What the evidence workbook contains.

It states plainly that DefectDojo records the ASV results an entity reports, does not perform ASV scans, is not an Approved Scanning Vendor, and does not validate an attestation, so a passing result is never inferred from an absence of findings.

English only. Per TRANSLATIONS.md the translations are regenerated from English.

The Pro side is DefectDojo-Inc/dojo-pro (private), on the same release line.

🤖 Generated with Claude Code