offer no guarantee that paginator sorting is alphabetical by CVE ID about cve-services

[kernelsmith]

Document in hard deploy release notes, of course anything can change in the future, but we want to dissuade users from building logic based on the current sort behavior.

And, traditionally we have (wanted to, at least) dissuade people from using the CVE-ID string as data. For example, consumers should not say: all CVE-IDs that start with CVE-22-* were submitted in the year 2022. That kind of query would give them (roughly) all CVE-IDs where the CVE-ID was reserved in 2022. They should query for all CVE-IDs where date_of_interest is between 2022-01-01T00:00:00 and 2022-12-31T23:59:59. At the start of the calendar year, many CNAs will submit CVEs that were reserved in the year prior, but not fully processed/assigned to a particular vuln, until the current year.

[zmanion]

Document in hard deploy release notes, of course anything can change in the future, but we want to dissuade users from building logic based on the current sort behavior.