Say what it takes to get a vulnerability-database page removed

The section asked operators to write in when they corrected an entry but never said what happens next, which left the pages reading as permanent. They are not meant to be. A page now comes down once every inaccurate record raised with that operator is corrected, and stays up until then because it describes something still true.

Author: Classic298

docs/security/supply-chain-security/vulnerability-databases/index.mdx

@@ -46,7 +46,7 @@ Where a record is genuinely live, we say so. Our published advisories, with affe
 2. **Do not present a record above its CNA's own classification or score.** Where a machine-generated score exceeds the CNA's, label it as your own assessment rather than as the record.
 3. **Keep the address published in your `security.txt` able to receive mail.** A contact that bounces is worse than no contact, because it consumes the reporter's time before failing.
 
-If you operate a database listed here and have corrected the entry, write to `security@openwebui.com` and we will update the page.
+If you operate a database listed here and have corrected an entry, write to `security@openwebui.com` and we will update the page to reflect it. Once every inaccurate record we have raised with you is corrected, we will take the page down entirely. We are glad to do that, and we would much rather have no pages here at all. Until then the page stays up, because it describes something that is still true.
 
 ## See also