Define which EoX states are in and out of scope

[kvandecr]

For different orgs, EoX can mean different things: end of development, end of vulnerability support, end of sales.
We should collect the different states that we would want to cover in this standard and define them unambiguously

Break out into #11 and #12

[santosomar]

Instead of out-of-scope only. We should start deciding on what fields/states should be optional and mandatory. This way we can be more inclusive of some states, but make them optional.

[tschmidtb51]

I think, we need to define the terms that we want to use...