Update security flow to report on GitHub

[bluwy]

Changes

Update SECURITY.md to use GitHub to report vulnerabilties. This is only for this repo, for other repos it'll fallback to the default in https://github.com/withastro/.github/blob/main/SECURITY.md (via email).

Starting this PR as a point of discussion, we could decide whether we want to do this or not. From Discord, this new flow will look like:

1. First, we need to enable the feature at https://github.com/withastro/astro/settings/security_analysis
2. When creating a bug report, users can choose to submit a security report instead, e.g. vite
3. Users can fill in the form to describe the severity and explain in private. Only repo admins can see unless they invite others.
4. We can triage them (comment, close, update descriptions/severity, etc similar to GH issues), and if it's real, we can work on a fix.
5. After a fix is done, we can update the report to describe the versions fixed, add extra explanation, etc, then accept the report.
6. Someone from GitHub will then publish the CVE for us.

Compared to the email approach, this allows us to easily publish CVE, credit the folks who found the vulnerability, and is easier to discover (npm audit).

Testing

n/a

Docs

n/a

[changeset-bot]

⚠️ No Changeset found

Latest commit: c0f0480

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[ematipico]

Sounds like a good starting point. I would argue that ALL repositories should follow the same approach, but that's not part of this PR.

[bluwy]

Oh I didn't know you can enable all on existing repos at once. I'm not sure how useful it is for every repo, but I suppose as a start we can test it out for the important repos.

[ematipico]

I am going to merge it, we can still apply changes if someone has some feedback to add

[bluwy]

I was also waiting for Fred's input before merging this (DM-ed him yesterday). Since we have Fred, Matthew, and Nate in the security contacts. Don't mind merging though but cc @FredKSchott in case he has thoughts on this.