Add guidance about year portion of the ID

[zmanion]

Add guidance to the assignment rules about the year portion of the ID.

Confirm that the year part of a CVE ID SHOULD (or MUST?) be the calendar year in which the vulnerability was first publicly disclosed or develop correct guidance.

[zmanion]

Somewhat related, .containers.cna.datePublished is optional. The year portion of datePublic should match the year portion of the CVE ID. Also maybe datePublic belongs in .cveMetadata since there should be public evidence to support this date (IOW, it is true for everyone, not just the container owner).