Clarification of "active and "stable" as factors for OSS SCRM.

[risacher]

From JITC comment: "Coordinator Comment and Justification: Suggest coming up with a more granular set of analysis criteria than “active and stable.” What characterizes a project as active and stable? Yearly updates? Monthly? 10 contributors? Hundreds? The subjectivity here is wide reaching and could lead us down a dangerous path if we do not bound the criteria.

Coordinator Recommended Change: Provide clarification as to what it means for an Open Source project to be both “active” and “stable” in order for appropriate supply chain risk analysis to be performed."