Clarify how score data is calculated

[daveverwer]

We no longer want to try to calculate score from specific versions as discussed in #2874, but the original problem that spawned that issue is that it wasn't clear where the dependency number was coming from.

Instead of changing how we calculate the score, we should be clear on which data the score is being calculated on.

We should add a sentence here:

that explains clearly where the data is coming from.