docs: add SeveritySource

Signed-off-by: knqyf263 <knqyf263@gmail.com>

docs/docs/scanner/vulnerability.md

@@ -71,7 +71,15 @@ If the CVSS score is also not provided, it falls back to [NVD][nvd].
 NVD and some vendors may delay severity analysis, while other vendors, such as Red Hat, are able to quickly evaluate and announce the severity of vulnerabilities.
 To avoid marking too many vulnerabilities as "UNKNOWN" severity, Trivy uses severity ratings from other vendors when the NVD information is not yet available.
 The order of preference for vendor severity data can be found [here](https://github.com/aquasecurity/trivy-db/blob/79d0fbd1e246f3c77eef4b9826fe4bf65940b221/pkg/vulnsrc/vulnerability/vulnerability.go#L17-L19).
-You can see all the vendor severity ratings for a given vulnerability by using the [JSON reporting format](../configuration/reporting.md#json) in Trivy.
+
+You can reference `SeveritySource` in the [JSON reporting format](../configuration/reporting.md#json) to see from where the severity is taken for a given vulnerability.
+
+```shell
+"SeveritySource": "debian",
+```
+
+
+In addition, you can see all the vendor severity ratings.
 
 ```json
 "VendorSeverity": {