riskScore and severity can be overridden in `buildRuleWithOverrides` - is this specifically intending to use the static values from the rule SO? I would guess if the value gets overridden we want to use that in the reason.