docs(1.7): clarify that an omitted nistQuantumSecurityLevel is not 0

schema/bom-1.7.proto

@@ -2321,7 +2321,7 @@ message CryptoProperties {
     repeated CryptoAlgorithmFunction cryptoFunctions = 9;
     // The classical security level that a cryptographic algorithm provides (in bits).
     optional int32 classicalSecurityLevel = 10;
-    // The NIST security strength category as defined in https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization/evaluation-criteria/security-(evaluation-criteria). A value of 0 indicates that none of the categories are met.
+    // The NIST security strength category as defined in https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization/evaluation-criteria/security-(evaluation-criteria). Omitting this property makes no NIST security category assertion and does not establish whether an assessment was performed; it is not evidence that the asset is quantum-safe. An explicit value of 0 indicates that none of the NIST-defined quantum security categories apply.
     optional int32 nistQuantumSecurityLevel = 11;
   } // end of AlgorithmProperties
 

schema/bom-1.7.schema.json

@@ -5495,7 +5495,7 @@
             "nistQuantumSecurityLevel": {
               "type": "integer",
               "title": "NIST security strength category",
-              "description": "The NIST security strength category as defined in https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization/evaluation-criteria/security-(evaluation-criteria). A value of 0 indicates that none of the categories are met.",
+              "description": "The NIST security strength category as defined in https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization/evaluation-criteria/security-(evaluation-criteria). Omitting this property makes no NIST security category assertion and does not establish whether an assessment was performed; it is not evidence that the asset is quantum-safe. An explicit value of 0 indicates that none of the NIST-defined quantum security categories apply.",
               "minimum": 0,
               "maximum": 6
             }

schema/bom-1.7.xsd

@@ -7289,7 +7289,10 @@ limitations under the License.
                                 <xs:documentation>
                                     The NIST security strength category as defined in
                                     https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization/evaluation-criteria/security-(evaluation-criteria).
-                                    A value of 0 indicates that none of the categories are met.
+                                    Omitting this property makes no NIST security category assertion and does
+                                    not establish whether an assessment was performed; it is not evidence that
+                                    the asset is quantum-safe. An explicit value of 0 indicates that none of the
+                                    NIST-defined quantum security categories apply.
                                 </xs:documentation>
                             </xs:annotation>
                             <xs:simpleType>