Assessing node risk and vulnerability in epidemics on networks