Update OSPS-BR-01.03

[Satarupa22-SD]

Removes from the requirement description.
CC: @funnelfiasco @eddie-knight

[eddie-knight]

good call

[evankanderson]

This seems like a good example of where the "and" rule in the styleguide may be going too far. The CI running untrusted code must be prevented from accessing either type of secure content:

1. credentials
2. assets such as release artifacts

Does this technically mean two separate checks, one for each type of content? Possibly, but that seems inconvenient, so I'm inclined to keep the scope of the rule.

[funnelfiasco]

I agree with Evan. I think we're fine to leave it as-is, but we could also say something like

prevent access to privileged content such as CI/CD credentials and release artifacts

although, arguably, the control should stop at "content" and the rest belongs in the recommendation.

[Satarupa22-SD]

@eddie-knight @evankanderson @funnelfiasco Should I close this PR then?

[evankanderson]

I'm fine with either closing this, or using Ben's wording.

[eddie-knight]

I think this is fine to close on account of the "and" being nested within privileged CI/CD elements.