CSET uses an invalid mechanism for vulnerability reporting

[faulkdev]

Under cisagov/cset Issues, the vulnerability reporting redirects to a CISA vulnerability disclosure policy that CLEARLY STATES vulnerability reports only accepted for certain .gov sites. Please fix vulnerability reporting for CSET.

Note, I will submit vulnerability reports as "Bugs" until the CSET maintainers identify a different option. Thanks.