Add CVSS Qualitative Severity Rating Scale decision point

[ahouseholder]

• resolves Consider a "CVSS Category" decision point #711, adding CVSS categories (Low, Medium, High, Critical) for use in future decision models
• adds an include_json:bool option (defaults to True) on the example_block() method so that docs can ask for a defined decision point block without the json example being included (by explicitly passing include_json=False)
• also fixed a small bug where example_block() accepted but did not use an indent:int parameter

Copilot Summary (edited to add CVSS spec link)

This pull request introduces a new decision point for the CVSS Qualitative Severity Rating Scale and updates the documentation accordingly. The most important changes include adding the new decision point, updating the documentation to include it, and modifying helper functions to support the new decision point.

Addition of CVSS Qualitative Severity Rating Scale:

• src/ssvc/decision_points/cvss/qualitative_severity.py: Added a new decision point for the CVSS Qualitative Severity Rating Scale, including definitions for different severity levels and a main function to print versions and diffs.

Documentation updates:

• docs/reference/decision_points/cvss/qualitative_severity.md: Added documentation for the CVSS Qualitative Severity Rating Scale, including an example block.
• mkdocs.yml: Updated the navigation to include the new Qualitative Severity documentation under CVSS-based decision points.

Helper function modifications:

• src/ssvc/doc_helpers.py: Modified the example_block function to include an optional JSON example and changed the indentation parameter to be more flexible. [1] [2]

[sei-renae]

lgtm

[sei-vsarvepalli]

There is a lingering CVSS versioning question on my mind. May be it should be an issue. The CVSS V4 is sometime represented with namespace version combo of cvss and 3.0.1 like in ATTACK_VECTOR_3_0_1 (in src/ssvc/decision_points/cvss/attack_vector.py file) for CVSS v4 Attack Vector - can we track mapping this way? This seems to be the case in this PR as well where CVSSv4 Quality metric shows us as version 1.0.0 with names space cvss

[ahouseholder]

The decision point versions are the decision point versions. They have no connection to CVSS versions.

The qualitative severity scale was added in CVSS v3.0 and has not changed (search each of these for "qualitative severity" to confirm), so by our decision point versioning rules, this one is 1.0.0.

• https://www.first.org/cvss/v3.0/specification-document
• https://www.first.org/cvss/v3.1/specification-document
• https://www.first.org/cvss/v4.0/specification-document