Add visualization / graph-layout metadata for architecture and attack-path views

[JohnASRG]

Motivation

When TARA tooling exchanges RDX, the human reviewer wants the architecture diagram and attack tree to render in the same shape they were authored in — not auto-layout each time. Today RDX has no layout hints, so the picture is lost on round-trip. Adding optional graph metadata lets producers preserve visual intent without forcing consumers to honor it.

Proposed change

1. component.graph and trustZone.graph (optional): { x, y, width, height, lane, anchor }.
2. attackPath.graph (optional): nodes[] and edges[] with x, y, bendpoints[], label style hints. Aligns with the edges-based attack path model from Make structured attackSteps the default and link to CVE/CWE/CAPEC/ATT&CK #48.
3. documentVisualization (optional, top-level): a free-form bag for tool-specific hints with a required tool and toolVersion so consumers can filter.
4. Strict opt-in: all graph data is optional; validators do not reject documents that omit it; tooling MAY ignore it.

References

• AI peer review, "Open topic — Visualization"
• Related: #48 (attack-path edges) and #49 (trust zones)

Acceptance criteria

• Graph metadata added in JSON Schema + XSD as optional fields
• One example demonstrates a component layout and an attack-path graph
• Methodology note: producers MUST treat layout as advisory, never structural

---

Surfaced by external AI peer review; see chat transcript for full review text.