Track adoption of potential OpenJSF Security Program

The OpenJS Foundation (OpenJSF) (and previously Node.js Foundation) has indicated plans of creating a new security program for the Node.js ecosystem, scoped more narrowly to the OpenJSF projects.

The previous Node.js Third-Party Ecosystem Security Program that was managed by the Node.js Security Working Group was scoped to:

• Managed a HackerOne Program with bounties for select NPM packages
• Managed a vulnerability database for NPM packages (initially donated by NSP)

Although it's not clear at this moment what this new program would entail, it seems like it might be a lift-and-shift, but with a focus on OpenJSF projects.

This issue is to track this work of the OpenJSF and to hold discussions on its applicability to LoopBack.

see: https://github.com/openjs-foundation/cross-project-council/issues/826#issuecomment-1077764219
see: https://github.com/nodejs/security-wg/issues/662#issuecomment-637623656
see: https://github.com/nodejs/security-wg/issues/494#issuecomment-780019393
see: https://github.com/nexB/vulnerablecode/issues/488#issuecomment-868489895

Inizia leggendo l'issue collegata del OpenJS Foundation cross-project-council e le issue del Node.js Security Working Group citate nella descrizione. Confronta il programma proposto con l'ambito precedente del database delle vulnerabilità di HackerOne e NPM, quindi documenta se e come si applica a LoopBack, una volta chiariti i piani di OpenJSF.