feat: Add custom guidance and appendices support

[leonamagaya]

What does this PR do?

This PR adds support for customizable guidance and appendices content in Cloudsplaining HTML reports. Users can now provide their own HTML content files to customize the guidance and appendices sections of their reports.

Key features:

• Custom content files: Users can create custom-guidance.html and custom-appendices.html files in their working directory
• Automatic detection: The system automatically detects and loads custom content files when present
• Fallback behavior: Falls back to default content when custom files don't exist
• Navigation control: Empty custom files hide the corresponding navigation sections entirely
• Security: Proper HTML escaping prevents JavaScript injection vulnerabilities
• Flexible usage: Supports mixed scenarios (one custom file, one default)

How to use this feature

Use Case 1: Custom Guidance Content

# Create custom guidance with organization-specific instructions
cat > custom-guidance.html << EOF
<h1>Custom Security Guidelines</h1>
<h2>Remediation Process</h2>
<p>1. Review the identified policy violations</p>
<p>2. Follow internal approval process for policy changes</p>
<p>3. Contact security team for assistance</p>
<h2>Additional Resources</h2>
<p><a href="https://internal-wiki.com/security">Internal Security Documentation</a></p>
EOF

# Standard cloudsplaining workflow (unchanged)
cloudsplaining download
cloudsplaining scan --input-file default.json --output reports/

Result: Report shows your custom guidance content instead of default AWS guidance.

Use Case 2: Custom Appendices with Additional Resources

# Add custom appendices with relevant links and information
cat > custom-appendices.html << EOF
<h1>Additional Resources</h1>
<h2>Internal Documentation</h2>
<ul>
<li><a href="https://docs.internal.com/iam-policies">IAM Policy Standards</a></li>
<li><a href="https://docs.internal.com/security-review">Security Review Process</a></li>
</ul>
<h2>Contact Information</h2>
<p>Security Team: security@organization.com</p>
<p>DevOps Team: devops@organization.com</p>
EOF

cloudsplaining scan --input-file default.json --output reports/

Result: Report shows custom appendices content instead of default AWS appendices

Use Case 3: Hide Sections Completely

# Hide both guidance and appendices sections
echo "" > custom-guidance.html
echo "" > custom-appendices.html

cloudsplaining scan --input-file default.json --output reports/

Result: No Guidance or Appendices tabs appear in the navigation

Use Case 4: Mixed Configuration

# Custom guidance, default appendices
cat > custom-guidance.html << EOF
<h1>Custom Remediation Steps</h1>
<p>Follow these steps to address policy issues...</p>
EOF
# Don't create custom-appendices.html

cloudsplaining scan --input-file default.json --output reports/

Result: Custom guidance tab + default AWS appendices tab

Use Case 5: Default Behavior (No Changes)

# Don't create any custom files - works exactly as before
cloudsplaining scan --input-file default.json --output reports/

Result: Standard AWS guidance and appendices content (existing behavior)

File Requirements

• Files must be named exactly custom-guidance.html and custom-appendices.html
• Files must be in the directory where you run the cloudsplaining scan command
• Files can contain any valid HTML content
• Empty files hide the corresponding navigation sections

What gif best describes this PR or how it makes you feel?

Completion checklist

• Additions and changes have unit tests
• The pull request has been appropriately labeled using the provided PR labels
• GitHub actions automation is passing (make test, make lint, make security-test, make test-js)
• If the UI contents or JavaScript files have been modified, generate a new example report:

[salesforce-cla]

Thanks for the contribution! Unfortunately we can't verify the commit author(s): Leona Magaya <l***@t***.com>. One possible solution is to add that email to your GitHub account. Alternatively you can change your commits to another email and force push the change. After getting your commits associated with your GitHub account, sign the Salesforce Inc. Contributor License Agreement and this Pull Request will be revalidated.

[kmcquade]

@leonamagaya sorry for the delay. I looked at this now and tried it out. It looks great! Thanks for contributing.

Running the tests. Once it passes I'm good to merge and approve.

[kmcquade]

looks like the linting failed. Can you run the tests on your end locally to make sure they pass first so we don't have to wait for the PR checks to fail?

Once they pass on your end we can re-run and hopefully be good to merge.

[leonamagaya]

@kmcquade Thank you for having a look. Let me run the tests and report back.

[leonamagaya]

fixed the linting issue..

I ran the tests but the ones that are failing are not related to my feature. However I can have a look and attempt fixing them if required.

FAILED test/command/test_expand_policy.py::ExpandPolicyClickTest::test_click_expand_policy_explicit_actions - AssertionError: False is not true
FAILED test/command/test_expand_policy.py::ExpandPolicyClickTest::test_click_expand_policy_wildcards - AssertionError: False is not true       
FAILED test/command/test_scan.py::ScanClickUnitTests::test_scan_example_file_with_click - AssertionError: False is not true```

[kmcquade]

@leonamagaya yeah sometimes that happens due to Policy Sentry's data source being updated - when Salesforce updates the AWS documentation with new actions. If you could fix those that would be fantastic

[leonamagaya]

@kmcquade the failing tests were caused by a Windows-specific issue with the shlex.split() function which strips backslashes from file paths when parsing command-line arguments in the test cases. On Windows file paths use backslashes as separators ( C:\Users\file.txt) but shlex.split() interprets these as escape characters and removes them resulting in invalid file paths that cause the commands to fail with non-zero exit codes.

I ran the tests using WSL and all 83 tests passed successfully. Therefore we do not need to make any changes. It is good to go if you agree.