Update vulnerability management and coordinated disclosure

[Ekhorn]

Documents the parts of 6.4 that were only in people's heads, and corrects two things that have gone stale.

• One vulnerability per advisory. Reports covering several independently fixable weaknesses are split and get a CVE each; separate reports of the same weakness are merged with every reporter credited. Cites CNA rules 4.1 and 4.2, which GitHub applies when issuing a CVE. This is already happening in practice and was undocumented.
• Severity. Scored with CVSS, agreed within the team rather than taken from the report, vector recorded alongside the score.
• Merge authority is now openremote/security-managers rather than "Product Owners".
• Removed the branch-protection workaround. GitHub does not run status checks on pull requests in a temporary private fork and does not enforce protection rules on the target branch, so nothing needs disabling. Docs.
• Publication does not always wait for a fix. An advisory with a planned fix is published once a release containing it is public. A confirmed vulnerability that will not be fixed is published anyway, stating that no fix is planned and documenting mitigations — matching the advisory tracker, which treats that case as Publishable.
• Split into Developing the fix, Merging and Publishing. The fork mechanics are unchanged.

[wborn]

This is an initial AI-assisted review.

Two workflow inconsistencies should be resolved before merging. The handbook broadens the CVE splitting rule beyond independently fixable vulnerabilities, and its publication rule conflicts with the related advisory tracker by requiring a fixed release even though valid vulnerabilities with no planned fix are explicitly considered publishable. There is also one smaller documentation cleanup around obsolete branch-protection guidance. Details are in the inline comments.

[ebariaux]

Has this been tested ? In all advisories I merged, I had to make changes to branch protection otherwise merge would be refused / fail.

[Ekhorn]

Not tested, but also I need to be more accurate here you'll have to use "Merge and bypass branch protections" and therefore you shouldn't need to touch the rules.

It also says this as a note:

This repository is protected by branch protections. These changes can only be merged by bypassing these protections.

[Ekhorn]

I updated it, but will need to test it before I resolve this thread.