Sensitive Data Exposure categories - update business impact, steps

[wesinator]

This PR updates the Sensitive Data Exposure Categories templates:

• I wanted to update the Business Impact section to highlight these vulnerabilities could enable exploitation leading to loss of product or service availability, which would lead to direct financial loss impact.
  Reputational risk, which is the curent focus of these business impact descriptions, is secondary and less important to potential impacts to service availability.
• Updated the steps list so it doesn't show two step 1's next to each other. I see these templates typically list the observed/actual in its own step one, this makes less sense if there is only one StR step.

[RRudder]

Thank you @wesinator for these updates.

What are your thoughts on this edit of the business impact?:
"This vulnerability could enable attacker exploitation that will disrupt product or service availability, leading to financial loss and impact customers’ trust in the application."

[wesinator]

Hi, that looks good- I will update shortly