Security Advisories: no guidance on what the file should contain after the TOML

The security advisory spec does not state what the markdown file should contain,
apart from the TOML front matter.

Browsing the RustSec advisory DB shows that their advisories typically contain a write-up of
the issue: title, summary, attack description, mitigations, timeline, acknowledgements, etc.

Presumably the same is intended for the Haskell advisory DB. But the TP (or the official
documentation that arises from it) ought to include guidance on the advisory file contents
beyond the TOML.