doc: add guidance on order vulns are listed in

Signed-off-by: Michael Dawson <[email protected]>

PR-URL: #41429
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Tobias Nießen <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Rich Trott <[email protected]>
Reviewed-By: Beth Griggs <[email protected]>

Author: mhdawson

doc/guides/security-release-process.md

@@ -21,6 +21,7 @@ information described.
     the date in the slug so that it will move to the top of the blog list.)
   * [ ] pre-release: _**LINK TO PR**_
   * [ ] post-release: _**LINK TO PR**_
+    * List vulnerabilities in order of descending severity
     * Ask the HackerOne reporter if they would like to be credited on the
       security release blog page:
       ```text