Confirm the OWASP review process items #620

Part of #607.

Why

The OWASP review has items that code cannot show. The team must confirm them so that the controls
document is complete.

Scope

• DPIA is current, and the data classification is recorded.
• Retention period for pupil files, request data and evidence in production.
• Threat model for sign-in, access control and the change request journeys (or a plan for one).
• Branch protection on main: a required reviewer who is not the author.
• Required reviewers on the production GitHub environment.
• MFA on the GitHub organisation and on Azure access.
• Signed commits: decide whether to require them.
• Logit log retention period.
• Incident response process and runbook, and the link to the SOC.

Done when

• Each item is confirmed, or has a follow-up issue.
• The OWASP Top 10 controls document is updated.