Make commit required in crosswalk schema (after backfill lands)

[chaksaray]

Summary

Tracks the third step of a three-step sequence agreed with astrogilda
during the #121 review (the crosswalk schema and validator PR). Not
actionable yet, this issue exists so the agreed plan doesn't quietly
get forgotten once the more visible parts (the schema PR, the backfill)
are done.

The agreed sequence

1. Add the crosswalk schema every crosswalk already declares #121, merged. Adds the crosswalk schema with commit as an
   optional field, so the four existing crosswalk files pass unchanged.
2. Backfill PR, not yet opened. astrogilda is pinning commit on
   all four existing crosswalks. Three sides need a real commit chosen
   by reading each upstream repo's history at the date the crosswalk
   states; the fourth (ave-to-ast10.json's target, the OWASP AST10
   site) has no repository to pin and correctly keeps
   checked_against_live_site instead.
3. This issue: make commit required outright, once step 2 has
   landed and nothing in the tree needs grandfathering anymore.

Why this sequencing, not a conditional required-field rule

Discussed directly in the #121 thread: the alternative (an if/then
conditional on file identity, similar to the draft-vs-active pattern
already used for records) would work, but astrogilda's proposed
sequence is better, it means the schema never has to carry a permanent
two-tier rule or an exception list naming which files are allowed to
skip the field. Once the backfill lands, requiring commit outright
costs nothing and never needs revisiting.

Scope, once triggered

• Confirm the backfill PR has actually merged and all crosswalk files in
  crosswalks/ carry a real commit value before touching anything
  here.
• Move commit from optional to required inside the endpoint
  definition in schema/crosswalk-1.0.0.schema.json.
• Re-run validate_crosswalks.py to confirm all crosswalks still pass
  with the stricter requirement, they should, given the backfill is
  what makes this safe to require.

Status

Blocked on the backfill PR landing first. Do not implement this
issue's change before that PR is merged, the four existing files would
fail validation if commit became required while any of them still
lack it.