TODO: create dedicated google group for CVE feed maintainers

[tabbysable]

While working on the migration of CVE feed generation to Cloud Build, we discovered that the CVE feed prow job reports its errors to security-tooling-private@kubernetes.io

Let's break this apart for separation of duties:

• create a new list
  • maybe call it cve-feed-maintainers@kubernetes.io ?
  • Populate it with the SIG leads and the CVE feed maintainers
• Update the prow job config to email errors to the new list
• create another new list k8s-infra-staging-sig-security@kubernetes.io (this is the hardcoded required name by the IAC script
  • Populate it with cve-feed-maintainers@kubernetes.io so that it will not require future maintenance

[tabbysable]

/assign mtardy
/triage accepted

[tabbysable]

After kubernetes/k8s.io#8846 was merged, I don't see the gcp project when I log into the gcp console.

This might be because something needs to be refreshed by sig-k8s-infra, or might be because it doesn't respect nested group membership. Need to ask about this.