Vulnerability doc should cover vulnerabilities of NuGet pkgs referenced by app

There's a gap in the scenarios covered by the [Container Vulnerability Workflow doc](https://github.com/dotnet/dotnet-docker/blob/main/documentation/vulnerability-reporting.md). If the container image contains a .NET app where that app references NuGet packages which are vulnerable, it will likely be reported by a vulnerability scanner. But following the steps of the workflow document will lead them to the point of logging an issue at https://github.com/dotnet/dotnet-docker which is not what we want since the cause of the vulnerability is the application itself. The document needs to be updated to account for this scenario.