public reference must not only be the CVE Record itself

[zmanion]

Much is said about the requirement for a public reference, add a sub-rule that the public reference MUST NOT only be to the CVE Record itself.

(If we were to decide to allow a CVE Record to "stand alone" then various rules about public references and initial public disdclosure would need to be reviewed and modified).