Qualys XML parser crashes when a QID has no glossary entry #16633

Bug description

The Qualys XML parser (dojo/tools/qualys/parser.py) aborts the whole import with AttributeError: 'NoneType' object has no attribute 'findtext' when any finding's QID has no matching VULN_DETAILS entry in the report's GLOSSARY.

In parse_finding, the glossary entry is read inside if vuln_item is not None:, but the severity line right after that block runs unconditionally:

sev = get_severity(vuln_item.findtext("SEVERITY"))

So a single unmatched QID raises instead of skipping (or degrading) that one finding, and no findings from the report are imported. The code after it would also read temp_cve_details, temp["vuln_name"] and friends that are only set inside the guarded block.

Steps to reproduce

Starting from unittests/scans/qualys/Qualys_Sample_Report.xml, any one of these reproduces it on dev:

1. Delete one <VULN_DETAILS id="qid_6">...</VULN_DETAILS> block from the glossary (a host still reports QID 6).
2. Empty the glossary: <GLOSSARY><VULN_DETAILS_LIST></VULN_DETAILS_LIST></GLOSSARY>.
3. Remove the GLOSSARY element entirely.
4. Put the glossary in a namespace (<GLOSSARY xmlns="urn:example">), or drop the id attribute from one VULN_DETAILS, or pad its id with a space.

Each raises the AttributeError above from parse_finding.

Expected behavior

A finding whose QID is missing from the glossary is either skipped with a logged warning or imported with what the host section provides (QID, port, result, dates, status), and the rest of the report imports normally.

Notes

Found while reviewing #16632, which changes how the glossary is looked up but deliberately keeps this behavior unchanged; the crash reproduces identically before and after that PR. An earlier suspicion that the parser could instead repeat the previous finding's details is not correct: vuln_item is reassigned on every iteration, so it always raises first.