Route the dependency-security doc from START-HERE

START-HERE routes by the question somebody arrived with, and 'are we exposed to
this CVE' had no entry - the SBOM was only mentioned in the Windows update doc,
which is not where anybody asking that would look.

docs/START-HERE.md

@@ -64,6 +64,16 @@ message or a sticky note. Read the "Before anybody relies on it" section first:
 there is one thing to test at your site before the first real credential goes
 through it.
 
+## Somebody is asking whether we are exposed to a published vulnerability
+
+[DEPENDENCY-SECURITY](DEPENDENCY-SECURITY.md). Every release installs
+`sbom.cdx.json`, a full inventory of third-party components and versions, so a
+security team can answer this on their own without access to anything here.
+
+In the repository, `scripts/scan_sbom.py` checks that inventory against
+published advisories and separates what ships from what only builds - the two
+are not the same finding, and only the first can fail a release.
+
 ## I am trying to understand why something is built this way
 
 [The ADRs](adr/ADR-001-asset-as-platform-contract.md). They are the decision record,