Define policy for when images get rebuilt to address package security vulnerabilities.

[MichaelSimons]

If there is a vulnerability in a package included in a .NET layer and there is a package patch available that addresses the CVE, when will the image get rebuilt to pick it up? This should be captured in the Image Update Policy. The image update policy only discusses base image and .NET servicing.

• We update the supported .NET images within 12 hours of any updates to their base images (e.g. debian:buster-slim, windows/nanoserver:1909, buildpack-deps:bionic-scm, etc.).
• We publish .NET images as part of releasing new versions of .NET including major/minor and servicing.

[mthalman]

The content in #4842 should be included with this.

[lbussell]

[Triage] We have something like this in Vulnerability Workflow, but we should have it written down more concretely when precisely we will re-build, and the Vulnerability Workflow should reference it.

[MichaelSimons]

This is a prereq to fixing #1455.