Clarify SCA-5 is about tool-based analysis

[joshuagl]

From the discussion in issue #48:

SCA-5 is about running tools to search for yet-to-be-discovered security issues.

Attempt to bring greater clarity to the requirement by changing the title and described benefits.

Fixes: #48