Those two discrepancies are not, to my knowledge, fixable on ASA platforms without breaking things for your clients. I haven't tested it again in about a year but the last time I tried, I had clients tell me their VPN stopped working.
If you want to give it a try...
For secure renegotiation, there is "anyconnect ssl rekey method none" in group-policy webvpn configuration mode. However, I've not had success with this setting raising the score with Qualys' checker.
For forward secrecy, try disabling all but ECDHE SSL ciphers in you ssl cipher list. You will also have to have an EC crypto key and that must have been used to sign your certificate signing reuqest and the certificate must be issued from a trusted root CA. You must also be using Anyconnect Apex licenses. (AC 4.x client is also required if you use this cipher type.)
https://supportforums.cisco.com/document/12943436/understanding-and-configuring-asa-ec-certificate-and-ec-ciphers
https://ltlnetworker.wordpress.com/2016/12/18/elliptic-curve-asa/
