Update content w/ correct assurance approach pg37

In the spreadsheet the assurance approach for this question was
marked as being 3answers-type2, which equates to:
- Service provider assertion
- Independent validation of assertion
- Independent testing of implementation

However the actual answers specified in the spreadsheet were
- Service provider assertion
- Independent testing of implementation
- CESG-assured components

…which match 3answers-type3.

This commit brings in the latest update to the content, which
correctly specifies the assurance approach as 3answers-type3.