Adding details about CVEs in third party dependencies

[Wadeck]

As the reporting of CVEs is a recurrent topic within the security team, I would like to clarify our standpoint.

[NotMyFault]

Quickly addressed the merge conflicts I introduced.

[kmartens27]

Hi @daniel-beck, I wanted to follow up and see if your concerns were addressed with the updates that have been made. If not, what could be changed to provide the right messaging?

[MarkEWaite]

I liked the phrasing of this enough to quote it in a community.jenkins.io post.

[daniel-beck]

Pending a conversation with Wadeck we've been postponing repeatedly since January…

[github-actions[bot]]

Please take a moment and address the merge conflicts of your pull request. Thanks!