Fix 508 accessibility issues on the website

[tinogutierrez]

This PR fixes all 6 acceptance criteria from #18031 (WAVE and ARC toolkit findings), addressing 508/WCAG accessibility violations on the ReportStream website.

Test Steps:

1. Navigate to http://localhost:3000
2. Tab to the "Skip to main content" link and press Enter — confirm focus moves to <main>
3. Open browser DevTools and confirm aria-controls on "About" and "Getting started" nav buttons matches the id of their dropdown menus
4. Inspect <header> elements — confirm only 2 exist and neither is inside <main>
5. Inspect the home logo link — confirm aria-label="ReportStream home"
6. Confirm header[aria-label="Primary navigation"] is present in the DOM

Changes

• ReportStreamHeader.tsx: Fix aria-controls/id mismatch on nav dropdown buttons — both now derive from menuName.toLowerCase().replace(/\s+/g, "-") + "-dropdown" (ARC issue 1)
• ReportStreamHeader.tsx: Add aria-label="Primary navigation" to primary <Header> landmark (ARC issue 2)
• ReportStreamHeader.tsx: Add aria-label="Secondary navigation" to auth <Header> landmark (ARC issue 2)
• ReportStreamHeader.tsx: Update home link from aria-label="Home" → aria-label="ReportStream home" to satisfy WCAG 2.5.3 Label in Name (ARC issue 4)
• MainLayout.tsx: Add USWDS skip nav link (<a class="usa-skipnav">) before the header (ARC issue 3)
• MainLayout.tsx: Add tabIndex={-1} to <main id="main-content"> so skip nav correctly moves keyboard focus (ARC issue 3)
• home/index.mdx: Replace <header> with <section> in the hero to remove a spurious banner landmark inside <main> (ARC issue 2)

Checklist

Testing

• Tested locally?
• Ran ./prime test or ./gradlew testSmoke against local Docker ReportStream container?
• (For Changes to /frontend-react/...) Ran npm run lint:write?
• Added tests?

Process

• Are there licensing issues with any new dependencies introduced?
• Includes a summary of what a code reviewer should test/verify?
• Updated the release notes?
• Database changes are submitted as a separate PR?
• DevOps team has been notified if PR requires ops support?

Linked Issues

• Fixes Fix 508 accessibility issues on the website #18031

To Be Done

No remaining work in this PR.

Specific Security-related subjects a reviewer should pay specific attention to

• Does this PR introduce new endpoints? No
• Does this PR include changes in authentication and/or authorization of existing endpoints? No
• Does this change introduce new dependencies that need vetting? No
• Does this change require changes to our infrastructure? No
• Does logging contain sensitive data? No
• Does this PR include or remove any sensitive information itself? No

[scott-aquia]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.