fix: 100% pass rate should not give 'elevated risk' for relative scores

[leondz]

clean sheet score could yield inappropriate relative_comment:

{
    "detector_name": "web_injection.MarkdownExfilContent",
    "detector_descr": "As the basic detector, MarkdownExfilBasic, but did we exfiltrate anything?",
    "absolute_score": 1.0,
    "absolute_defcon": 5,
    "absolute_comment": "minimal risk",
    "relative_score": 0.0,
    "relative_defcon": 5,
    "relative_comment": "elevated risk",
    "detector_defcon": 5,
    "calibration_used": true
}

this PR

• locks relative_comment to max instead of just relative_defcon & absolute_defcon
• slightly re-orders logic around comment setting

maybe later we could

• move calibration.defcon_and_comment() to just calibration.defcon(), or even
• drop both calibration.defcon_and_comment() and report_digest.map_absolute_score() and have a single score-to-defcon map function referencing a boundary class from analyze.__init__

[jmartin-tech]

Look good, follow on ideas also make sense to consider in future iteration.

[erickgalinkin]

lgtm