Update Section 4.5 to cover identification of vulnerabilities

[clintwilson]

In #34, Section 4.5 is updated to address the requirement that CAs perform penetration testing. Section 4.4 indicates the CA must have a process for identifying vulnerabilities.

Performing penetration tests is only one method of identifying potential vulnerabilities in the CA's infrastructure. Section 4.5 could be expanded upon to provide additional ways CA should be able to identify vulnerabilities, e.g. periodic scanning, OS updates, security bulletins, etc.