[SEC-WG] Create a private repository for the reports

We should create a private repository that only this team and the TC have access to, in order to keep track of open reports, or to transfer a report to this repository if it was made publicly in an issue.

The workflow would be as follows:

• The report is submitted either through the GitHub Security Advisory or via email to webpack-security@openjsf.org.
• An issue is created in the new repository:
  • If the report came through the GitHub Security Advisory, it is referenced in the issue.
  • If it came via email, the email is copied into the issue, and if a potential vulnerability is confirmed, a GitHub Security Advisory is created in the appropriate repository.
• The workflow then continues as usual.

Keep in mind that Webpack has many repositories, and keeping track of open reports is quite complicated. Until GitHub implements a solution to manage this in a single place, having this repository would be useful (https://github.com/orgs/community/discussions/183774). In case GitHub implements such a solution in the future, this repository could be used to transfer any vulnerabilities that were made public.

Start by reviewing the proposed workflow for GitHub Security Advisories, email reports to webpack-security@openjsf.org, and issues in the new private repository. Confirm that the repository can restrict access to the security team and TC, preserve references or copied emails, and support transferring publicly reported vulnerabilities.