SV-204441 Change NA to Manual Review

[karikarshivani]

The current code allows the user to change the MFA requirement by updating an input.

If there is no evidence of multifactor authentication, this is a finding.

If MFA is not used, the control should at least require a manual review (or perhaps a failure). One way to do that is to change this:

impact 0.0
  describe 'The system is not smartcard enabled' do
    skip 'The system is not using Smartcards / PIVs to fulfil the MFA requirement, this control is Not Applicable.'
  end

To this:

  describe 'The system is not smartcard enabled' do
    skip 'Manually review that AO-approved multifactor authentication is used and configured'
  end