fix(security-md): assert properties, not wording

The standard demanded the literal strings "CVSS v3.1", "90 day", "5 business day" and the about.gitlab.com URL, failing four of five consumers whose policies were sound but phrased differently. It now asserts three properties, each still able to fail: a private disclosure route, a severity scale, a response timeline. The route regex matches "confidential issue", not bare "confidential", which would match an assessment's "Transmission Confidentiality" row. Template unchanged.

Measured: reference, kaniko, egress pass outright; manifold, postern, assay keep failing on genuine gaps, closed in their own MRs.

Stacked on !67 (merged) and the reference-check deletion MR; merge those first.