Track adoption of potential OpenJSF Security Program

The OpenJS Foundation (OpenJSF) (and previously Node.js Foundation) has indicated plans of creating a new security program for the Node.js ecosystem, scoped more narrowly to the OpenJSF projects.

The previous Node.js Third-Party Ecosystem Security Program that was managed by the Node.js Security Working Group was scoped to:

• Managed a HackerOne Program with bounties for select NPM packages
• Managed a vulnerability database for NPM packages (initially donated by NSP)

Although it's not clear at this moment what this new program would entail, it seems like it might be a lift-and-shift, but with a focus on OpenJSF projects.

This issue is to track this work of the OpenJSF and to hold discussions on its applicability to LoopBack.

see: https://github.com/openjs-foundation/cross-project-council/issues/826#issuecomment-1077764219
see: https://github.com/nodejs/security-wg/issues/662#issuecomment-637623656
see: https://github.com/nodejs/security-wg/issues/494#issuecomment-780019393
see: https://github.com/nexB/vulnerablecode/issues/488#issuecomment-868489895

Start by reading the linked OpenJS Foundation cross-project-council issue and the Node.js Security Working Group issues cited in the description. Compare the proposed program with the previous HackerOne and NPM vulnerability-database scope, then document whether and how it applies to LoopBack once the OpenJSF plans are clear.