OQS security response process

[SWilson4]

This PR proposes a security response process for OQS. Please read it over and provide feedback. I expect it will undergo a fair bit of revision, but hopefully this gives us a starting point.

I have left a number of comments requesting feedback on specific points throughout the document. These are clearly marked by COMMENT. I'll keep the PR in draft until all of these are removed.

Closes #60.

[dstebila]

I think this can be marked as "Ready for review" and proceed with getting final reviews towards merging.

[SWilson4]

@open-quantum-safe/tsc @open-quantum-safe/security-managers

I think that all discussions have now been resolved satisfactorily. Please review the latest version so we can get this merged!

[baentsch]

See additional single comments and apologies for not wrapping them into one coherent review - I simply didn't assume there'd still be so many items in need of clarification :-(

[SWilson4]

See additional single comments and apologies for not wrapping them into one coherent review - I simply didn't assume there'd still be so many items in need of clarification :-(

The one-liners are addressed in the latest commit; others are addressed in the relevant threads.

[dstebila]

I think most members of the proposed Vulnerability Management Team has commented on this, but tagging those who haven't yet commented just in case: @bhess, @praveksharma

[bhess]

Thanks for this work @SWilson4! See the single comment inline.

[SWilson4]

@baentsch @bhess @brian-jarvis-aws Your feedback is (hopefully) addressed in the latest commit.

[baentsch]

The more I think about my recent commentary/concerns, and also taking into account security notification registrations by commercial product organizations (another one just arrived in our Inboxes), what about the proposal to ask those organizations whether they'd be willing to provide personnel for the VMT? This would make it more resilient and align OQS external and internal interests. Topic for discussion next Tuesday @dstebila ?

[dstebila]

The more I think about my recent commentary/concerns, and also taking into account security notification registrations by commercial product organizations (another one just arrived in our Inboxes), what about the proposal to ask those organizations whether they'd be willing to provide personnel for the VMT? This would make it more resilient and align OQS external and internal interests. Topic for discussion next Tuesday @dstebila ?

Sure, we can send an email to the new security announcements list (once it's populated) asking for volunteers from there interested in being more active in OQS security responses. But I don't think a nything needs to change in this PR for us to do that.