feat(lab5): ZAP baseline + auth + Semgrep + correlation

[ashuno]

Goal: Run DAST (ZAP baseline + authenticated) and SAST (Semgrep) against Juice Shop v20.0.0, then correlate at least one vulnerability found by both tools.

Changes:

Added submissions/lab5.md with complete lab analysis

Testing:

ZAP baseline scan: 10 alert types, 41 instances, completed in ~2 minutes

ZAP authenticated scan: 12 alert types, 37 instances, active scan ran ~5 minutes

Verified auth-only finding: SQL Injection at /rest/products/search?q='(

Semgrep scan: 22 findings (12 ERROR, 10 WARNING) against v20.0.0 source

Correlation confirmed: SQL injection in routes/search.ts:23 detected by both tools

Artifacts & Screenshots:

submissions/lab5.md — full analysis report

Checklist items:

Title is clear (feat(lab5): ...)

No secrets/large temp files committed

Submission file at submissions/lab5.md exists