docs: Add non-parser Test Types to product hierarchy documentation

[skywalke34]

Add detailed explanation of the two categories of Test Types in DefectDojo:

• Parser-based Test Types that work with imported scanner output files
• Non-parser Test Types for manual findings creation. Currently, API Test, Static Check, Pen Test, Web Application Test, Security Research, Threat Modeling, Manual Code Review are non-parser test types.

Clarify that non-parser Test Types appear in the "Scan Type" dropdown when creating a new test but not when importing scans, helping users understand when to use each type.

[paulOsinski]

Approved ^ @skywalke34 you can merge this with bugfix if you like and it'll be released to our docs site more quickly

[dryrunsecurity]

🔴 Risk threshold exceeded.

This pull request contains sensitive edits to critical files like context_processors.py and base.html, with multiple potential security risks including session timing vulnerabilities, broad exception handling, and client-side session management issues that could expose sensitive information or allow manipulation of session mechanisms.

⚠️ Configured Codepaths Edit in dojo/context_processors.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

⚠️ Configured Codepaths Edit in dojo/templates/base.html

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

💭 Unconfirmed Findings (8)

Vulnerability	Potential Dependency Version Pinning Risk
Description	Pinning to specific commit hashes in .github/workflows/release-x-manual-helm-chart.yml can introduce risks if the referenced commit contains unverified or malicious changes

Vulnerability	Potential Unverified Dependency Updates
Description	Dependency updates in docs/package-lock.json, docs/package.json, and requirements.txt without thorough testing can introduce unknown security risks

Vulnerability	Session Timing Side-Channel Information Leak
Description	In dojo/context_processors.py, session timing information is exposed which could potentially be used to infer user session details

Vulnerability	Broad Exception Handling
Description	In dojo/context_processors.py, a catch-all exception handler silently returns an empty dictionary, potentially masking runtime errors

Vulnerability	Potential Information Disclosure via Session Expiry Notification
Description	Session expiry warning mechanism in dojo/settings/settings.dist.py might inadvertently expose sensitive information about session management

Vulnerability	Configurable Session Warning Interval Risks
Description	Configurable session warning interval in dojo/settings/settings.dist.py could potentially be manipulated to probe session management mechanisms

Vulnerability	Client-Side Session Timing Exposure
Description	Session timeout logic in dojo/templates/base.html is implemented entirely client-side using JavaScript, which could potentially be manipulated

Vulnerability	Lack of Server-Side Session Validation
Description	No corresponding server-side validation in dojo/templates/base.html to enforce session timeout, potentially giving users a false sense of security

We've notified @mtesauro.

---

All finding details can be found in the DryRun Security Dashboard.

[Maffooch]

@skywalke34 this one might have to go into the dev branch since it was started from the dev branch. Other options is to create a new PR based from the bugfix branch

[paulOsinski]

@Maffooch @skywalke34 my mistake!

[mtesauro]

Approved