Add constraint to validate component "used-by" link

[Rene2mt]

Constraint Task

Per issue #806, as an SSP author, I need to make sure any of my components that have used-by link(s) are referencing a valid component in the SSP via a URI fragment, so that FedRAMP stakeholders understand understand what components are "used by" what components.

Intended Outcome

Create a new constraint validating that any component with a "used-by" link must have a URI fragment that represents the UUID of a valid component within the SSP.

Syntax Type

This is optional core OSCAL syntax.

Allowed Values

There are no relevant allowed values.

Metapath(s) to Content

<!-- context metapath target -->
"/system-security-plan/system-implementation/component"

<!-- constraint level -->
level="ERROR"

<!-- constraint target -->
target="//component[./protocol]/link[@rel='used-by']"

<!-- constraint test -->
count(//component[@uuid=substring-after(./@href, "#")]) = 1

Purpose of the OSCAL Content

No response

Dependencies

No response

Acceptance Criteria

• All OSCAL adoption content affected by the change in this issue have been updated in accordance with the Documentation Standards.
  • Explanation is present and accurate
  • sample content is present and accurate
  • Metapath is present, accurate, and does not throw a syntax exception using oscal-cli metaschema metapath eval -e "expression".
• All constraints associated with the review task have been created
• The appropriate example OSCAL file is updated with content that demonstrates the FedRAMP-compliant OSCAL presentation.
• The constraint conforms to the FedRAMP Constraint Style Guide.
  • All automated and manual review items that identify non-conformance are addressed; or technical leads (David Waltermire; AJ Stein) have approved the PR and “override” the style guide requirement.
• Known good test content is created for unit testing.
• Known bad test content is created for unit testing.
• Unit testing is configured to run both known good and known bad test content examples.
• Passing and failing unit tests, and corresponding test vectors in the form of known valid and invalid OSCAL test files, are created or updated for each constraint.
• A Pull Request (PR) is submitted that fully addresses the goals section of the User Story in the issue.
• This issue is referenced in the PR.

Other information

For more details, see #806 (comment) and #806 (comment)

NOTE: Documentation to be handled in GSA/automate.fedramp.gov#131