Ensure that there is only one customizations in blueprint remedations

[Mab879]

Also ensure that [customizations] is before any sub sections as to better follow the TOML spec.

Before this commit if rule added a [customizations] section there would be two [customizations] section thus causing an error. An example of such a rule is enabling fips.

Assisted by: OpenCode using OpenAI models and Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[jan-cerny]

Using the XCCDF file tests/API/XCCDF/unittests/test_remediation_blueprint.xccdf.xml from this PR I have verified:

• that the OpenSCAP from the current main branch generates an invalid TOML which has 2 [customizations] sections
• that with this PR it's fixed so that OpenSCAP generates a TOML file containing only 1 [customizations] that contains both the static partitioning_mode = "raw" and content remediation fips=1.

###############################################################################
#
# Blueprint for No profile (default benchmark)
#
# Profile Description:
# Not available
#
# Benchmark ID:  xccdf_moc.elpmaxe.www_benchmark_test
# Benchmark Version:  1.0
# XCCDF Version:  1.2
#
# This file was generated by OpenSCAP 1.4.5 using:
# $ oscap xccdf generate fix --fix-type blueprint blueprint.xccdf.xml
#
# This Blueprint is generated from an OpenSCAP profile without preliminary evaluation.
# It attempts to fix every selected rule, even if the system is already compliant.
#
# How to apply this Blueprint:
# composer-cli blueprints push blueprint.toml
#
###############################################################################

name = "hardened_(null)"
description = "No profile (default benchmark)"
version = "1.0"

[customizations]
partitioning_mode = "raw"
fips=1

[customizations.openscap]
profile_id = ""
# If your hardening data stream is not part of the 'scap-security-guide' package
# provide the absolute path to it (from the root of the image filesystem).
# datastream = "/usr/share/xml/scap/ssg/content/ssg-xxxxx-ds.xml"

distro = rhel-80

[[packages]]
name = "aide"
version = "*"

[[customizations.filesystem]]
mountpoint = "/home"
size = 1

[[customizations.filesystem]]
mountpoint = "/tmp"
size = 2

[customizations.kernel]
append = "foo=bar audit=1"

[customizations.services]
enabled = ["sshd","usbguard"]
disabled = ["kdump"]
masked = ["evil"]