docs: Clarify use of --metrics and epss options

[terriko]

• A bit of additional documentation in MANUAL.md and the cli options so we explicitly say that --epss-* need to be used with --metrics or they won't have an effect

Originally posted by @terriko in #3618 (review)

I'm going to merge #3618 which will disable epss metrics by default (for performance reasons) but I think we should be explicit that the --metrics will be needed before any of the epss options take effect.

For beginners, some steps to get started:

1. Try doing a grep -ri epss doc/ to see where epss is mentioned in our docs and make sure that it's clear that --metrics will need to be used for the EPSS data to get used. (grep -ri means search recursively and case-insensitively. So it'll search all of the doc/ files.)
2. Do this search for epss again on the README.md file (which isn't in the doc/ folder).
3. Take a look at the help text on the cli options in cve_bin_tool/cli.py and update the epss related ones. Remember to be concise since these help options have to fit on a screen and many people keep to an 80-character width in console views.

[terriko]

This is probably simple enough that a beginner could do it (though you'll have to be prepared to read the docs so you understand what you're doing), so I'm pasting the new contributor tips in here:

New Contribution Tips

This file contains the tips/links I put into bugs marked "good first issue" so
that new contributors have the guidance they need right in the bug.

Short tips for new contributors:

• cve-bin-tool's contributor docs
• If you've contributed to open source but not this project, you might just want our checklist for a great pull request
• cve-bin-tool uses https://www.conventionalcommits.org/ style for commit messages, and we have a test that checks the title of your pull request (PR). A good potential title for this one is in the title of this issue.
• You can make an issue auto close by including a comment "fixes #ISSUENUMBER" in your PR comments where ISSUENUMBER is the actual number of the issue. This "links" the issue to the pull request.

Claiming issues:

• You do not need to have an issue assigned to you before you work on it. To "claim" an issue either make a linked pull request or comment on the issue saying you'll be working on it.
• If someone else has already commented or opened a pull request, assume it is claimed and find another issue to work on.
• If it's been more than 1 week without progress, you can ask in a comment if the claimant is still working on it before claiming it yourself (give them at least 3 days to respond before assuming they have moved on).

[Mayankrai449]

hey @terriko I would like to work on this as my first contribution

[terriko]

@Mayankrai449 It looks like @ffontaine already has a fix in progress that I'll probably merge once tests are done, but if you could document that new behaviour, that would be great.

(The change is basically "if --epss-percentile or --epss-probability is set, then --metrics will be automatically enabled" -- so you'd say that instead of noting that --epss-* won't work unless --metrics is enabled.)

[Mayankrai449]

@terriko Sure, I will look into it.