Fix/reduce max scan duration

[ayman-art]

Description

Fine-tuned ZAP scan configuration to reduce report phase duration while maintaining active scan coverage.

• Closes Limit the zap nightly security scan #2347

Problem

The Ajax Spider phase had no duration limit, which caused the report generation phase to exceed the GitHub Actions 6-hour limit.

Changes

.github/workflows/zap-nightly-scan.yml

• Added ajaxSpider.maxDuration=10 to cap the spider phase at 10 minutes
• scanner.maxScanDurationInMins=180 remains unchanged

How it was tested

Multiple spider and scan duration combinations were tested to find the optimal fit within GitHub Actions time limits. The two best candidates were ajaxSpider.maxDuration=10 with scanner.maxScanDurationInMins=180 (~3h 21m), and ajaxSpider.maxDuration=20 with scanner.maxScanDurationInMins=120 (~3h). The 10/180 configuration was chosen as it dedicates more time to active scanning.

• Run with ajaxSpider.maxDuration=10, scanner.maxScanDurationInMins=180
• Run with ajaxSpider.maxDuration=20, scanner.maxScanDurationInMins=120