Umbrella issue: Migrate CVE feed to run under cloud build

[tabbysable]

As extensively discussed in the Tooling subproject meetings, we are migrating the CVE feed generation off of the privileged build cluster. The recommended replacement from sig-k8s-infra folks is to run it in Cloud Build.

Overall steps:

• Create a GCP project
  • Done in Create staging project for k/sig-security repo cloud build k8s.io#7838
• Assign permissions for the GCP project
  • Documented in TODO: create dedicated google group for CVE feed maintainers #149
• Update GCS bucket permissions to allow cloud build job to write to it
• Define and deploy the cloud build job that will run the generation script
  • First step here is to figure out how to do so, probably by reading TF examples in https://github.com/kubernetes/k8s.io/blob/main/infra/gcp/terraform/

[tabbysable]

/triage accepted