docs(1.7): clarify that an omitted nistQuantumSecurityLevel is not 0

schema/bom-1.7.proto

@@ -2321,7 +2321,7 @@ message CryptoProperties {
     repeated CryptoAlgorithmFunction cryptoFunctions = 9;
     // The classical security level that a cryptographic algorithm provides (in bits).
     optional int32 classicalSecurityLevel = 10;
-    // The NIST security strength category as defined in https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization/evaluation-criteria/security-(evaluation-criteria). A value of 0 indicates that none of the categories are met.
+    // The NIST security strength category as defined in https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization/evaluation-criteria/security-(evaluation-criteria). This property is optional. Omitting it makes no NIST security category assertion and does not establish whether an assessment was performed; a value of 0 states that none of the categories are met. An unset integer field may read back as 0, so the raw value cannot distinguish absence from an explicit zero: consumers must check whether the field is present rather than comparing the value to 0. An omitted value is not 0, and is not evidence that the asset is quantum-safe.
     optional int32 nistQuantumSecurityLevel = 11;
   } // end of AlgorithmProperties
 

schema/bom-1.7.schema.json

@@ -5495,7 +5495,7 @@
             "nistQuantumSecurityLevel": {
               "type": "integer",
               "title": "NIST security strength category",
-              "description": "The NIST security strength category as defined in https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization/evaluation-criteria/security-(evaluation-criteria). A value of 0 indicates that none of the categories are met.",
+              "description": "The NIST security strength category as defined in https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization/evaluation-criteria/security-(evaluation-criteria). This property is optional. Omitting it makes no NIST security category assertion and does not establish whether an assessment was performed; a value of 0 states that none of the categories are met. An unset integer field may read back as 0, so the raw value cannot distinguish absence from an explicit zero: consumers must check whether the field is present rather than comparing the value to 0. An omitted value is not 0, and is not evidence that the asset is quantum-safe.",
               "minimum": 0,
               "maximum": 6
             }

schema/bom-1.7.xsd

@@ -7289,7 +7289,13 @@ limitations under the License.
                                 <xs:documentation>
                                     The NIST security strength category as defined in
                                     https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization/evaluation-criteria/security-(evaluation-criteria).
-                                    A value of 0 indicates that none of the categories are met.
+                                    This property is optional. Omitting it makes no NIST security category
+                                    assertion and does not establish whether an assessment was performed;
+                                    a value of 0 states that none of the categories are met. An unset integer
+                                    field may read back as 0, so the raw value cannot distinguish absence from
+                                    an explicit zero: consumers must check whether the field is present rather
+                                    than comparing the value to 0. An omitted value is not 0, and is not
+                                    evidence that the asset is quantum-safe.
                                 </xs:documentation>
                             </xs:annotation>
                             <xs:simpleType>