Improve Metrics dashboard with organization/product performance and comparison reports

[mojtaba13133]

The current Metrics section is quite limited — it only shows fixed data based on a single month, with no way to compare against previous months or years, and no real performance-style reporting.

A vulnerability management system like DefectDojo should be able to provide proper management-level reports for security managers, showing:

• The status of each organization's/product's vulnerabilities (discovered vs mitigated)
• Which organizations or products are doing better vs worse
• Whether an organization is improving over time compared to previous months/years — both in terms of writing more secure code (fewer vulnerabilities found) and in terms of mitigation speed (faster fixes)

Specifically, it would be great to have the following metrics available, broken down by organization and by product, with the ability to compare across time periods (month-over-month, year-over-year):

1. Number of vulnerabilities discovered (total) per organization
2. Number of vulnerabilities discovered (total) per product
3. Number of vulnerabilities mitigated per organization
4. Number of vulnerabilities mitigated per product
5. Average time to mitigate Critical vulnerabilities per organization
6. Average time to mitigate High vulnerabilities per organization
7. Average time to mitigate Medium vulnerabilities per organization
8. Average time to mitigate Low vulnerabilities per organization
9. Average age of not-yet-mitigated Critical vulnerabilities per organization
10. Average age of not-yet-mitigated High vulnerabilities per organization
11. Average age of not-yet-mitigated Medium vulnerabilities per organization
12. Average age of not-yet-mitigated Low vulnerabilities per organization
13. Most frequently discovered vulnerability type across all products (WSTG ID) — i.e. recurring vulnerability patterns

These metrics together would let security managers get a clear, trend-based view of each organization's/product's security posture over time, instead of just a static monthly snapshot. It would also make it much easier to identify organizations that need more support/training vs organizations that are consistently improving.

I understand this is a fairly significant addition to the reporting/metrics engine, but it would be a big value-add for organizations using DefectDojo at scale.