What does it mean that a "UTxO sits at a script address".
What is a script address?
UTxOs are always associated with some address or "public key".
Traditionally, on Bitcoin and Cardano that meant a wallet address. And someone could only spend a UTxO in a transaction signed by the private key of the associated address. When you send BTC or ADA to someone, you are really just creating new UTxOs that can only be spent by that person.
So, you could say that a UTxO exists or "sits" at a wallet address whose owner is allowed to spend it.
What does it mean that "utxo sits at script address". What script address?
Once smart contracts are enabled on Cardano, UTxOs can also be associated with "script addresses". Similar to wallet adresses, this is a way of determining when a UTxO can be spent. A "script" is just that, a piece of code that says "yes" or "no" when someone tries to spend a UTxO. (This is how smart contracts work on Cardano, by combining different scripts to control the storage of value and data.)
So, you could say that a UTxO "sits" at the address of the script that determines when that UTxO can be spent.