Add additional external references

[stevespringett]

Additional external references are planned and include:

• attestation
  • Human or machine readable attestation
• threat-model
  • Current threat model, DFD, etc, including any human readable model, or machine readable model (eg. OTM)
• distribution-intake
  • Where something was published to. This is often the same as distribution however, ASF and others have dedicated publishing processes
• vulnerability-assertion
  • NIST Vulnerability Disclosure Reports (VDR)
• exploitability-statement
  • VEX (or whatever this will be called in the future)
• pentest-report
  • Results from a penetration test
• static-analysis-report
  • Code quality static analysis, SAST reports, SARIF, etc
• dynamic-analysis-report
  • Runtime (dynamic analysis) reports including DAST, fuzzing, etc
• component-analysis-report
  • Reports for Software Composition Analysis (SCA), Containers, IaC, and other components
• maturity-report
  • Describes how mature development practices are (BSIMM, OWASP SAMM, NIST SSDF, etc)
• certification-report
  • Includes appstore certifications, ISO certifications (eg. 27001), SOC2, etc

Excluded from this list are external references that already have tickets or are part of other work planned for v1.5

[stevespringett]

Also need to add:

• codified-infrastructure
  • Infrastructure as Code (IaC) including Terraform and other forms of codified infrastructure