Add node:test coverage for parse-zap-report helpers

[AlphaSudo]

Summary

normalizeRisk in scripts/parse-zap-report.js has subtle behavior (riskcode vs riskdesc) documented in comments. Small regressions are easy to introduce without automated checks.

Scope (good first issue)

• Extract normalizeRisk (and optionally normalizeRouteish) into a tiny module under scripts/ that parse-zap-report.js requires, or add a scripts/*.test.js file using Node's built-in node:test (Node 22 is already used in CI).
• Add tests covering: riskcode mapping, riskdesc with parenthetical confidence (e.g. informational labeled with high confidence), and at least one normalizeRouteish case (UUID or numeric id collapsing).

CI follow-up (optional stretch)

• Add a CI step to run node --test scripts/*.test.js if you use node:test; keep runtime minimal.

Acceptance criteria

• Tests run locally with a single documented command in the PR description.
• No change to parse output for existing golden/typical ZAP JSON shapes (or document intentional fixes with tests).

Files

• scripts/parse-zap-report.js (refactor as needed)
• New test file(s) under scripts/