Allow for industry/sector specific safety impacts

[ahouseholder]

When a vulnerability is published in a central place such as NVD, would it be assigned multiple public impacts based on industry, letting the vendor choose which industries they support up to one step knowledge? (Not sure how these questions should be answered, but maybe it can be handled with NVD issuing partial information and then ISAC's potentially issuing further guidance for their constituencies. )

Extends #1 , #2

[ahouseholder]

As an example, consider CISA's critical infrastructure sectors or ISACs/ISAOs as potentially having their own safety impact answers for vuls.

I think we'd want to make any sector-based stuff optional, as in you only need it if the impact within a sector is way different from the broader impact. Not setting an expectation that you need to complete a sector impact for every sector for every vul.