fixed Vendor Management calculations
More fixes to the Executive Report.

All sections now use raw sql, and return correct results.
The final Composite Risk score for the entire bank has been added
to the end of the report.