Clarify security team teams, roles and responsibilities

[joestringer]

There are multiple locations where security teams are managed:

• https://github.com/cilium/community/blob/main/roles/Security-Team.md (@cilium/security ?)
  • https://github.com/cilium/community/blob/main/ladder/teams/security.yaml
  • https://cilium.slack.com #security-team channel
  • security@cilium.io mailinglist group
• @cilium/security-org

The differences between these groups may not be entirely obvious, but we should look into the organization and repository settings and the team memberships, and clarify the scope for each group as well as who has access to those options.

The related one I think is pretty clear is @cilium/github-sec. This has a smaller, different scope specifically related to ensuring that GitHub workflows are written following security best practices. It's documented in the project-wide reviewers (should probably be called org-wide).

We may want to consider as well how subprojects get access to security reports.

[joestringer]

FYI currently GitHub does not support having multiple security groups within an organization, so the security handling for Cilium, Tetragon and so on are all centralized. It sounds like there is intent to make this more flexible in future, so we can keep an eye out on that in case we would like different groups to handle security advisories (GHSA) in different repositories.