notes.yml: add link for Docker CVE's