Add SSVC doc explaining "human-scale bottleneck" idea

[ahouseholder]

resolves #1033

---

This pull request adds a new documentation file explaining the role of SSVC (Stakeholder-Specific Vulnerability Categorization) as a human-scale bottleneck in automated vulnerability response processes. The document clarifies how SSVC condenses complex, automated data into manageable decision points, and emphasizes the importance of human oversight in policy definition and governance.

Key additions to documentation:

• Introduced a comprehensive explanation of SSVC as a human-scale bottleneck, ensuring transparency and accountability in automated vulnerability response workflows.
• Detailed the characteristics of SSVC decision points, including their ordinal, orthogonal, and "chunky" nature, which keeps the decision table compact and understandable.
• Explained how the SSVC decision table codifies policy as code, mapping technical inputs to business-aligned outcomes, and outlined criteria for effective table design.
• Provided guidance on governance and policy refinement, describing how SSVC enables straightforward modification and clear accountability for risk owners.
• Clarified that SSVC is not a process bottleneck—automation can occur throughout, with humans responsible for designing and governing the decision framework rather than reviewing every decision.

[Copilot]

Pull request overview

Adds a new How-To documentation page explaining SSVC’s role as a “human-scale bottleneck” between large-scale automated vulnerability data collection/analysis and large-scale operational response, emphasizing policy governance and accountability.

Changes:

• Added a new documentation page describing SSVC decision points as a compact, human-governable interface in automated workflows.
• Documented design characteristics (ordinal/orthogonal/chunky) and how decision tables encode organizational policy and governance refinement.

---

You can also share your feedback on Copilot code review. Take the survey.

[sei-renae]

Some high level notes:

1. This does not read like a "how to guide" per the diataxis framework. It seems more akin to an "explanation."
2. I don't know who the audience is
3. H2 "The Decision Table: Policy as Code" lost my interest as a reader, if I'm expecting to learn about a human bottleneck

[sei-renae]

See comments in-line and in the Conversation.