Add SSVC doc explaining "human-scale bottleneck" idea

[ahouseholder]

resolves #1033

---

This pull request adds a new documentation file explaining the role of SSVC (Stakeholder-Specific Vulnerability Categorization) as a human-scale bottleneck in automated vulnerability response processes. The document clarifies how SSVC condenses complex, automated data into manageable decision points, and emphasizes the importance of human oversight in policy definition and governance.

Key additions to documentation:

• Introduced a comprehensive explanation of SSVC as a human-scale bottleneck, ensuring transparency and accountability in automated vulnerability response workflows.
• Detailed the characteristics of SSVC decision points, including their ordinal, orthogonal, and "chunky" nature, which keeps the decision table compact and understandable.
• Explained how the SSVC decision table codifies policy as code, mapping technical inputs to business-aligned outcomes, and outlined criteria for effective table design.
• Provided guidance on governance and policy refinement, describing how SSVC enables straightforward modification and clear accountability for risk owners.
• Clarified that SSVC is not a process bottleneck—automation can occur throughout, with humans responsible for designing and governing the decision framework rather than reviewing every decision.

[Copilot]

Pull request overview

Adds a new How-To documentation page explaining SSVC’s role as a “human-scale bottleneck” between large-scale automated vulnerability data collection/analysis and large-scale operational response, emphasizing policy governance and accountability.

Changes:

• Added a new documentation page describing SSVC decision points as a compact, human-governable interface in automated workflows.
• Documented design characteristics (ordinal/orthogonal/chunky) and how decision tables encode organizational policy and governance refinement.

---

You can also share your feedback on Copilot code review. Take the survey.