Sensitive Data Exposure categories - update business impact, steps

[wesinator]

This PR updates the Sensitive Data Exposure Categories templates:

• I wanted to update the Business Impact section to highlight these vulnerabilities could enable exploitation leading to loss of product or service availability, which would lead to direct financial loss impact.
  Reputational risk, which is the curent focus of these business impact descriptions, is secondary and less important to potential impacts to service availability.
• Updated the steps list so it doesn't show two step 1's next to each other. I see these templates typically list the observed/actual in its own step one, this makes less sense if there is only one StR step.