v1.2.0: add owasp_ast schema field

[chaksaray]

Summary

Adds owasp_ast as a real schema field, replacing the current
crosswalk-file-only mapping to OWASP's Agentic Skills Top 10 (AST10)
with a proper, first-class field, the same treatment owasp_asi,
owasp_mcp, mitre_atlas, and nist_ai_rmf already get.

Current state

The AST10 mapping exists only in crosswalks/ave-to-ast10.json, a
separate file, not queryable the way the schema's other framework
fields are. README's own crosswalk table already lists this as planned:
"no dedicated schema field yet (owasp_ast planned)."

The crosswalk file's own coverage summary: 37 AVE records referenced
across 8 of AST10's 10 categories (AST08 and AST10 currently have no
mapped records at all in this file); 19 AVE records are explicitly
unmapped, mostly data-exfiltration/disclosure/standalone-injection
classes that don't fit AST10's scope, per the file's own
note_on_unmapped.

Scope

• Add owasp_ast as an optional array field to
  schema/ave-record-1.1.0.schema.json, pattern-matched to AST01
  through AST10, same shape as the existing owasp_asi field.
• Additive, optional field: minor version bump only, 1.1.0 to 1.2.0,
  per docs/specs/scaling-and-governance.md Section 2. No breaking
  change to any existing record.
• Backfill owasp_ast on the AVE records already listed in
  crosswalks/ave-to-ast10.json's own mappings[].ave_ids arrays.
  This file has no per-record confidence field (its confidence/rationale
  lives in prose notes per AST category, a coarser grain than a
  per-record flag), so the backfill is a direct read of its existing
  mappings, not a confidence-filtered subset. Records the file lists
  under gaps_in_ave or gaps_in_ast10 are explicitly not a mapping
  and should not be backfilled.
• The crosswalk file itself stays, doesn't get deleted, it documents the
  mapping rationale (including the gaps_in_ave/gaps_in_ast10 and
  revision_note context) the schema field alone can't carry.

Out of scope

• Re-litigating which specific AVE records map to which AST10
  categories, that's the crosswalk file's own job. This issue is about
  adding the schema field and backfilling from the mappings as they
  currently stand in crosswalks/ave-to-ast10.json, not redoing the
  mapping work.
• A separate, independent AVE-to-AST10 crosswalk exists as an open PR
  against the upstream OWASP AST10 project itself
  (kenhuangus/agentic-skills-top-10#10), with its own confidence
  grading (direct/partial) and an open CodeRabbit review comment on
  one mapping (AVE-2026-00057 -> AST08) not yet addressed. That crosswalk
  is a different file living in a different repository, not the one this
  issue backfills from, and its outcome doesn't block or inform this
  issue.