docs(risk-acceptance): one risk acceptance per finding, and the default expiration date on requests

[blakeaowens]

Description

Docs for three risk acceptance changes in DefectDojo Pro (the Pro risk acceptance page only):

• One risk acceptance per finding. A finding that is already risk accepted, through another Full Risk Acceptance or a Simple Risk Acceptance, cannot be added to a second one, and with Risk Acceptances 2.0 enabled neither can a finding an undecided security exception request names. The New Risk Acceptance and Add Findings pickers list only findings that are not risk accepted, not duplicates and not waiting on a request; the API returns a 400 naming each held finding (example body included); standing acceptances and the Rules Engine skip a held finding.
• Request Security Exception starts Accept Until at today plus the Default Risk Acceptance Days setting, counted from the request; clearing it asks for an exception that never expires, and the API's omitted and null dates behave the same way.
• Default dates apply to the accept_risks actions and to an empty Default Risk Acceptance Days setting (read as 180).

Documentation

docs/content/triage_findings/findings_workflows/PRO__risk_acceptance.md (English only; language copies are generated).

Checklist

• Rebased against the dev branch.
• Documentation updated.

🤖 Generated with Claude Code