docs(app-scan): record why Microsoft products can't use the CPE/cvelistV5 path

Investigated adding Windows Server (and SharePoint) to the app-CVE scanner to
beat the Wazuh CTI delay. Verified against live data that the premise doesn't
hold: NVD gives MS OS entries as rangeless CPEs
(cpe:2.3:o:microsoft:windows_server_2016:-:* with versionEndExcluding=null) and
cvelistV5 MS records use lessThan:'publication' — neither carries the fixed
build, so neither distinguishes a patched host from an unpatched one. _in_range
already rejects those wildcard/'-' versions, so registry entries would match
nothing while spending NVD quota. Leave a note where the next person will look
instead of shipping dead entries; MSRC (KB + FixedBuild) is the viable source.

app/services/app_cve_scanner_service.py

@@ -119,6 +119,14 @@ _REGISTRY: List[tuple] = [
 # version (13/14/15) without ranges, so it needs the Intune security-patch
 # level + Android bulletin parsing — a separate feature.
 # ponytail: iOS/iPadOS only; add Android when the patch-level path is built.
+# NOTE: Microsoft OS/products are deliberately NOT in this registry. NVD models
+# them as rangeless CPEs (`cpe:2.3:o:microsoft:windows_server_2016:-:*` with no
+# versionEndExcluding) and cvelistV5 MS records use `lessThan: "publication"` —
+# neither carries the fixed BUILD, so neither can tell a patched host from an
+# unpatched one. _in_range() correctly rejects those wildcard/`-` versions, so
+# adding them here would match nothing while burning NVD quota. MSRC (KB +
+# FixedBuild per product) is the only source with MS patch state — see the
+# msrc remediation path.
 _OS_REGISTRY: List[tuple] = [
     (re.compile(r"ipad", re.I), {"key": "cpe:apple:ipados",
                                  "cpe": "cpe:2.3:o:apple:ipados", "label": "Apple iPadOS"}),