Updates to the vendor security review process

Why is this change being made?

<!

Describe in detail answer to question on why this change is being proposed, in accordance with our value of Transparency

--> This MR updates the Vendor Security Review Handbook page to align on the current vendor security review process that is in place. A decision tree has also been added to help GitLabbers determine when a security review is required.

Does this MR meet the acceptance criteria?

Assign to DRI

• Did you assign this change to the correct DRI of the page or information you are changing?

Conformity

• Added description to this MR explaining the reasons for the proposed change, per say-why-not-just-what