✨ Factor private vulnerability reporting into Security-Policy

[bmendonca3]

What this PR does

Adds GitHub private vulnerability reporting as an experimental Security-Policy probe and factors it into the Security-Policy score.

Specifically, this:

• reads GitHub private vulnerability reporting status through the REST API when available
• returns OutcomeNotApplicable when the setting is unavailable or unsupported
• gives Security-Policy an 8/10 floor when private vulnerability reporting is enabled
• keeps existing 10/10 behavior for complete security policies
• updates generated probe/check docs and OSPS baseline coverage notes

Refs #2465.

Testing

• go test ./probes/securityPolicyPrivateVulnerabilityReportingEnabled -count=1
• go test ./checks/evaluation -run TestSecurityPolicy -count=1
• go test ./checks/raw -run 'TestSecurityPolicy|TestPrivateVulnerabilityReportingStatus' -count=1
• go test ./checks -run TestSecurityPolicy -count=1
• go test ./clients/githubrepo -run TestDoesNotExist -count=1
• go test ./checks/... ./probes/securityPolicyPrivateVulnerabilityReportingEnabled -count=1
• make validate-docs
• git diff --check

Security-Policy now factors GitHub private vulnerability reporting into the score when the setting is available.

[justaugustus]

See note about AI contributions —> ossf/allstar#841 (comment)

[github-actions]

This pull request has been marked stale because it has been open for 10 days with no activity