Update vendor risk taxonomy with security ratings daily

Vendor security ratings arrive as a raw feed and aren't tied to records, so risk profiles go stale. This links ratings to your taxonomy so risk owners see current posture within minutes.