Fix profile resolution when children of nested controls selected

[aj-stein-nist]

Committer Notes

Closes #232.

All Submissions:

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same update/change?
• Have you squashed any non-relevant commits and commit messages? [instructions]
• Do all automated CI/CD checks pass?

Changes to Core Features:

• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your core changes, as applicable?
• Have you included examples of how to use your new feature(s)?
• Have you updated all website and readme documentation affected by the changes you made?

[aj-stein-nist]

@david-waltermire I am going to ask for a preliminary review but the fix seems pretty simple so I am worried I am misunderstand the scope of the issue. Additionally, when running the regression test, I am notice in the gov.nist.secauto.oscal.lib.profile.resolver.ProfileResolver.resolveProfile() function I get the following warning because of c1.1 control being a dupe at the handleMerge() stage because of duplicate index records.

10:39:58.383 [main] DEBUG gov.nist.secauto.oscal.lib.profile.resolver.ProfileResolver.resolveImport(ProfileResolver.java:322) - resolving profile import 'issue106-catalog.xml'
10:39:58.540 [main] ERROR gov.nist.secauto.metaschema.model.common.constraint.LoggingConstraintValidationHandler.logConstraint(LoggingConstraintValidationHandler.java:121) - ERROR: (/catalog/control[1]) Expect constraint 'prop[@name='status']/@value=('withdrawn','Withdrawn') or part[@name='statement']' did not match the data at path '/catalog/control[1]'
10:39:58.543 [main] ERROR gov.nist.secauto.metaschema.model.common.constraint.LoggingConstraintValidationHandler.logConstraint(LoggingConstraintValidationHandler.java:121) - ERROR: (/catalog/control[1]/control[1]) Expect constraint 'prop[@name='status']/@value=('withdrawn','Withdrawn') or part[@name='statement']' did not match the data at path '/catalog/control[1]/control[1]'
10:43:53.065 [main] DEBUG gov.nist.secauto.oscal.lib.profile.resolver.selection.DefaultResult.promoteControl(DefaultResult.java:103) - promoting control 'c1.1'
10:45:05.843 [main] DEBUG gov.nist.secauto.oscal.lib.profile.resolver.selection.DefaultResult.removeControl(DefaultResult.java:199) - Requesting removal of control 'c1'.
10:53:58.002 [main] DEBUG gov.nist.secauto.oscal.lib.profile.resolver.support.BasicIndexer.removeItem(BasicIndexer.java:246) - Removing CONTROL 'c1' from index.
10:55:28.634 [main] DEBUG gov.nist.secauto.oscal.lib.profile.resolver.ProfileResolver.structureFlat(ProfileResolver.java:462) - applying flat structuring directive
10:57:38.239 [main] DEBUG gov.nist.secauto.oscal.lib.profile.resolver.selection.DefaultResult.promoteControl(DefaultResult.java:103) - promoting control 'c1.1'
10:59:44.536 [main] WARN  gov.nist.secauto.oscal.lib.profile.resolver.support.BasicIndexer.addItem(BasicIndexer.java:218) - Duplicate control found with identifier c1.1 in index.

I cannot seem to track that down and I am not sure given the warning type on the log record if it is serious, but since the document should be reindex at this point, I am left scratching my head. Let me know.