Fix CVSS score and privilege guidance

[killerlux]

The example vector uses S:C, so it scores 10.0 rather than 9.8 in the FIRST calculator.

The self-registration examples also had PR:N and PR:L backwards. FIRST defines the metrics as:

PR:N: "The attacker is unauthorized prior to attack"

PR:L: "The attacker requires privileges that provide basic user capabilities"

Source: CVSS v3.1 specification

If exploitation needs the privileges of a signed-in basic account, open registration does not remove that requirement.