[Github] Security impact field in templates

.github/ISSUE_TEMPLATE/change-request.yml

@@ -0,0 +1,38 @@
+name: Configuration Change
+description: Tracker issues for configuration changes
+labels: [ needs-triage ]
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: What is the change?
+    validations:
+      required: true
+  - type: dropdown
+    id: security-impact
+    attributes:
+      label: Security Impact
+      description: Level of security impact of the change
+      options:
+          - No Impact
+          - Low
+          - Medium
+          - High
+    validations:
+      required: true
+  - type: textarea
+    id: security-impact-description
+    attributes:
+      label: Security Impact Description
+      description: If the impact is No Impact or Low, justify that rating. If the impact is Medium or High, describe the security impact and any mitigations.
+    validations:
+      required: true
+  - type: checkboxes
+    id: appsec-signoff
+    attributes:
+      label: Appsec Signoff
+      description: If the security impact is High, has the change been reviewed and approved by the Appsec team?
+      options:
+          - label: Reviewed and approved
+            required: false

.github/pull_request_template.md

@@ -0,0 +1,20 @@
+### Change Description
+
+Fixes #<issue_number>.
+
+### Security Assessment
+
+- [ ] This change has a high security impact
+  - [ ] Required: and the impact has been assessed and approved by appsec
+- [ ] This change has a medium security impact
+- [ ] This change has a low security impact
+- [ ] This change has no security impact
+
+Description of the security impact and necessary mitigations:
+
+- For none/low impact: a quick one/two sentence justification of the rating.
+  - Example: "Docs only", "Low-level refactoring of non-security code", etc.
+- For medium/high impact: provide a description of the impact and the mitigations in place.
+  - Example: "New UI text field added in analogy to existing elements, with input strings escaped and validated against code injection"
+
+(Reviewers: please confirm the security impact before approving)