feat: implement generic mitigation-aware rule evaluation (fixes #21)

[Tanishq1030]

Description

This PR implements a generic, mitigation-aware rule evaluation layer inside Anchor's governance engine. Previously, rules defining min_mitigations were ignored during scan evaluation. With this change, the evaluation pipeline checks for active inline mitigations in the source code to determine compliance before registering findings.

Acceptance Criteria

• Implement mitigation-aware evaluation in the engine.
• Support enforcement of min_mitigations.
• Rules can evaluate mitigations before generating findings.
• Existing rules continue to function without modification.
• Documentation updated to describe mitigation-aware evaluation.

Changes

• Engine (anchor/core/engine.py): Added a generic mitigation-aware evaluation stage in evaluate_candidates. The engine parses comments matching # anchor: (mitigate|mitigation|mitigated) <rule_id> and discards candidate violations if the count of mitigations matches or exceeds min_mitigations.
• Parser (anchor/core/loader.py & anchor/cli.py): Updated loaders to read and propagate min_mitigations from federated domain policy files to the active ruleset.
• Tests (tests/unit/test_mitigations.py): Added unit tests coverage for:
  • Non-mitigated findings generating violations.
  • Satisfied single mitigation discard.
  • Satisfied/unsatisfied multi-mitigation requirements (e.g. min_mitigations: 2).
• Documentation (DOCS/research/mitigation_evaluation.md): Created documentation detailing the evaluation workflow, code syntax, and config parameters.
• Benchmark (benchmarks/bench_anchor.py): Disabled remote ledger and relay environment variables to prevent HTTP blockages/timeouts during test runs.

Related Issues

Fixes #21

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.