Two fields named `security-policy`

[funnelfiasco]

I happened to notice that the specification has two fields named security-policy: vulnerability.security-policy and documentation.security-policy. The template uses different example entries for each, so it's not clear if this is intended to be the same thing or not.

Since there's namespacing, it's not the worst thing to happen, but it can cause confusion when being glanced at by a human.

I spoke privately to @eddie-knight and he said the vulnerability entry should just be policy.

[eddie-knight]

Yes, I agree that this is an oversight.

@jmeridth I believe this should be considered a fix (not breaking / major), in spite of the fact that it will require a breaking change to the structs in si-tooling. Thoughts?

[jmeridth]

@eddie-knight I trust your instinct. My stance is usually, if breaking, it should be major to notify downstream. If we are downstream...then we are aware.