cra-kit: correct Art. 14 reporting mechanics (SRP/CSIRT/EUVD) and remove deleted ROADMAP references

[sameehj]

Summary

Follow-up to #574. Fixes a systematic inaccuracy in the CRA kit and cleans up references to ROADMAP.md (removed in this PR).

• Correct the Art. 14 reporting mechanic. The kit previously described reports as going "to ENISA" directly. Under Art. 14/16 a manufacturer files via the ENISA Single Reporting Platform (SRP) to the CSIRT designated as coordinator, with ENISA notified simultaneously; fixed vulnerabilities are then published to the EUVD. Corrected across the shortlist, cheat sheet, glossary, slide outline, and SKILL.md.
• vulnerability-handling-process.md: adds a "how a report is filed (SRP → CSIRT + ENISA → EUVD)" section; adds the severe-incident track (Art. 14(3), 1-month final report); reframes on-call from a staffing gap to wolfSSL's existing follow-the-sun coverage plus an explicit compliance commitment; updates the diagram, SLA table, and references.
• Status change (please review): flips the vulnerability-handling headline from 🟡 "public SLA pending leadership approval" to a ✅ "wolfSSL Inc. commits to Art. 13/14 compliance" statement, and drops the "(proposed; pending leadership approval)" qualifier from the SLA section. 00-INDEX.md is updated to match so the index and the document agree.
• Ties the EU Authorised Representative to the reporting end-point (Art. 14(7)): since wolfSSL Inc. has no EU main establishment, the AR's Member State determines the coordinator CSIRT.
• Glossary: new SRP / CSIRT / EUVD entries; tightened support-period wording to match Art. 13(2).
• conformity-assessment-route.md: removes internal-correspondence detail from a customer-facing template.
• Removes ROADMAP.md and all remaining links/text references to it.

Test plan

• cra-kit/scripts/validate.sh passes (auditor packet validation OK)
• cbom-draft.cdx.json still parses as valid JSON
• No remaining ROADMAP references in cra-kit/
• 00-INDEX.md status matches vulnerability-handling-process.md