What “sink” means

A sink is a method or API that performs the dangerous action (e.g., deserialization, JNDI lookup, executing data, opening sockets).

Identify sources (untrusted input entry points),

These are dangerous primitives that have a "high" chance of being the vulnerable method as outlined in the CVE description, in short, we are making assumptions.