Migrating off GitHub for advisory publication and CVE assignment

As discussed on Zulip, [#ask-anything > how to leave GitHub](https://jupyter.zulipchat.com/#narrow/channel/103349-ask-anything/topic/how.20to.20leave.20GitHub/with/591902803), at this point it is really tempting to move off GitHub for security advisories because 3/4 core features are broken:
- merging PRs from security forks does not work (for months now!)
- CVE assignment does not work reliably - GitHub is not following the timelines expected from authorities or self-imposed 2-3 working days (now taking over a month!) [ref 1](https://github.com/orgs/community/discussions/200225), [ref 2](https://github.com/orgs/community/discussions/199123)
- advisory publication to GitHub Advisory Database is delayed and ends up riddled with mistakes due to human reviewers modifying and misinterpreting the text; then for weeks no one responds to correction requests

The only, and not insignificant, feature that still works is that almost every security researcher is happy to use private vulnerability reporting form. We could keep using it, just handle the rest of the process elsewhere.

### Process today

Since I cannot merge PRs from security forks this is the workaround I use when merging multiple PRs:
1. Go to the private fork PR say `https://github.com/jupyterlab/jupyterlab-ghsa-89vp-jrxv-24w8/pull/1`
2. Append `.diff` so it becomes `https://github.com/jupyterlab/jupyterlab-ghsa-89vp-jrxv-24w8/pull/1.diff`
3. Save the diff locally
4. On a new branch run `git apply ghsa-89vp-jrxv-24w8.diff`
5. `git commit . -m 'Fix for GHSA-89vp-jrxv-24w8'`
6. Repeat for all patches to be merged at once, resolving conflicts as needed
7. Backport to patch branches created of stable branches
8. Open pull requests using public PRs (as recommended by GitHub support) or push directly if feeling adventurous/when severity demands it
9. MERGE WITHOUT SQUASHING to preserve individual commits (of course, I forgot about it)

### Fully-featured alternatives

IMO we should evaluate GitLab. I know that GitLab is not an alternative for folks who worry about sovereignty and governance etc, but AFAIK it is the only other large CVE Numbering Authority (CNA) that has feautre-parity with GitHub. I hear it has improved recently. It also has private forks that we could use to review security patches.

There is also Bitbucket (Atlassian is a CNA for everything on bitbucket) but basic features of Bitbucket like issues were being deprecated recently so I am not sure how long-lived it will be for open-source users.

Gitea is a CNA but AFAIK only for itself, not for repositories hosted with Gitea.

### Security-focused and bug-bounty platforms

The alternatives per quick search are security and bug bonty platforms, many of which are also CNAs, e.g. Snyk, HackerOne, Bugcrowd, Patchstack, YesWeHack and Intigriti.

### Jupyter could become a CNA

Another path forward would be to apply for Jupyter Foundation to become a CNA, as are Python Software Foundation, Django Software Foundation, Apache Software Foundation, Eclipse Foundation, Erlang Ecosystem Foundation, The Document Foundation and PHP Group.

OpenSSF has a guide to becoming a CNA for Open Source projects ([announcement](https://openssf.org/blog/2023/11/27/openssf-introduces-guide-to-becoming-a-cve-numbering-authority-as-an-open-source-project/)): https://github.com/ossf/wg-vulnerability-disclosures/blob/main/docs/guides/becoming-a-cna-as-an-open-source-org-or-project.md

Start with the linked Zulip discussion and the documented GitHub workflow in this issue; compare GitLab and the other named advisory/CNA options against private reporting, fork review, CVE assignment, and publication. Done means selecting a supported path and documenting an agreed migration or CNA plan, including how security patches are merged and published.

Written by the indexing model from the issue text.