add a documentation guide to fix false positive reports

I love this project and would like to give something back by fixing some of the open false positive reports. But I don't know where to start.

I would expect that fixing a false positive would be comparing if a certain dependency in combination with a CVE was found and excluding it from the result, comparable to the suppression functionality.

I would like to see a guide (e.g. added to the contribution guide or in the documentation on the website) on how to fix a false positive as contribution to this project. I hope that more developers (including myself) would be enabled to contribute simple fixes to false positives to the main project. Instead of just reporting a false positive more and more would be able to provide a PR to fix the false positive.