dhi: add scout scoring (#23805)

<!--Delete sections as needed -->

## Description

Added information about Scout scoring to DHI docs for legal.


https://deploy-preview-23805--docsdocker.netlify.app/dhi/features/support/

## Related issues or tickets

<!-- Related issues, pull requests, or Jira tickets -->

## Reviews

<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->

- [ ] Editorial review
- [ ] Product review

Signed-off-by: Craig Osterhout <[email protected]>

Author: craig-osterhout

content/manuals/dhi/features/support.md

@@ -25,4 +25,44 @@ response to security threats and operational issues:
 
 This level of support ensures that organizations can rely on DHI for their
 mission-critical applications, with the assurance that security and stability
-are maintained proactively.
+are maintained proactively.
+
+### How Docker defines Critical and High severity vulnerabilities
+
+For consistent and accurate severity classification, Docker uses the same
+severity and scoring principles as [Docker
+Scout](../../scout/deep-dive/advisory-db-sources.md) when determining whether a
+CVE is considered Critical or High.
+
+#### Severity and scoring priority
+
+Docker Scout uses two main principles when determining severity and scoring for
+CVEs:
+
+   - Source priority
+   - CVSS version preference
+
+For source priority, Docker Scout follows this order:
+
+  1. Vendor advisories: Scout always uses the severity and scoring data from the
+     source that matches the package and version. For example, Debian data for
+     Debian packages.
+
+  2. NIST scoring data: If the vendor doesn't provide scoring data for a CVE,
+     Scout falls back to NIST scoring data.
+
+For CVSS version preference, once Scout has selected a source, it prefers CVSS
+v4 over v3 when both are available, as v4 is the more modern and precise scoring
+model.
+
+#### Vulnerability matching
+
+Traditional tools often rely on broad [Common Product Enumeration
+(CPE)](https://en.wikipedia.org/wiki/Common_Platform_Enumeration) matching,
+which can lead to many false-positive results.
+
+Docker Scout uses [Package URLs
+(PURLs)](https://github.com/package-url/purl-spec) to match packages against
+CVEs, which yields more precise identification of vulnerabilities. PURLs
+significantly reduce the chances of false positives, focusing only on genuinely
+affected packages.