Add an optional reference OpenEoX artefact in CSAF

[sonnyvanlingen]

As can be read in 3.1.2.2 Branches Type - Category, there are a number of values that can be used as categories of the branch including legacy. Currently legacy is defined as follows:

The value legacy indicates an entry that has reached its end of life.

This is a slightly limited way of describing lifecycle management. Also, many of the TC members are involved in the OpenEoX initiative to try and standardize the product EOX information.

This work is still ongoing, but in preparation of the OpenEoX TC delivering its standard and implementation guidance, I would like to already mark the future need for a reference in CSAF to include OpenEoX artefacts.

[tschmidtb51]

I like the idea. Nevertheless, we need at least a CS of OpenEoX with enough certainty that it doesn't change anymore to include it.

[sonnyvanlingen]

Agree - it may be premature to include OpenEoX before the TC provided a Committee Specification.