Warn assignee of security bugs when phab reviewer is not CC'd on the bug

NOTE: This is a request for sending a message to the assignee, NOT a request to auto-CC folks to a security bug!

Phabricator will give patch reviewers access to a differential even if it's attached to a security bug they don't have access to. This is desired behavior as far as requesting review goes, but it definitely can leave the reviewer in the dark what the purpose is. We do not want to auto-CC the reviewer to the bug itself because this could be abused (especially in the case of "review groups" where the requestor may not know all the members). Phabricator is the way it is because people did not want Phabricator giving them errors saying they couldn't request review from someone. So we can sometimes end up in a broken state.

Proposed solution: autonag messages the bug assignee that the reviewer they picked cannot access the bug itself and should be CC'd if that's appropriate. This could be an email or a needinfo in the bug, whichever you think is most appropriate.

It would be straightforward to check that the reviewer is not CC'd on the bug and that is probably good enough. In some cases that approach will over-nag because the reviewer might be one of the handful of people who have default access to the bug without needing to be CC'd. At the moment I think that's OK because it will get people in the habit of CCing people on security bugs to make sure they can see things rather than make possibly-incorrect assumptions about access.

Workaround: if the reviewer can't access the bug they can ask the patch creator for a CC. It's possible this status quo is the lower-annoyance solution.

Start by locating the autonag implementation and existing message paths in the bugbot repository, then trace how reviewer and bug access are represented. The issue is complete when an assignee is warned about a reviewer who cannot access the security bug, without automatically CCing that reviewer; the chosen email or needinfo behavior should be covered by the project’s existing checks.