doc: mention DEPENDENCY custom field for H1 reports

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: #64634
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

Author: RafaelGSS

doc/contributing/security-release-process.md

@@ -67,6 +67,8 @@ The current security stewards are documented in the main Node.js
 * [ ] 3\. **Assigning Severity and Writing Team Summary:**
   * [ ] Assign a severity and write a team summary on HackerOne for the reports
     chosen in the `vulnerabilities.json`.
+  * [ ] If a report targets a Node.js dependency, such as `undici` or `llhttp`,
+    make sure to update the `DEPENDENCY` custom field on HackerOne.
   * Run `git node security --sync` to update severity and summary in
     `vulnerabilities.json`.