Move security reporting proposal to stage 3

[MarcinHoppe]

Moving the security reporting proposal to stage 3, per discussion in #326.

[mikesamuel]

The difference between stage 2 and 3 is at STAGING_PROCESS

(Emphases added)

Stage 2 - Accepted Proposal

Proposals in this stage are nearly complete. They may be in a pilot or trial-run mode for a limited audience, or pending legal review. They may be awaiting budget approval. The purpose of this stage is to complete any operational checks, such as acquiring budget, access, or Board approval if needed, before launching the program.

Is the bolded part primarily what we need to discuss?

Stage 3 - Complete

The proposal is now an adopted policy or program of the Foundation, and is owned by the committee or role identified. It is expected that the policy or program will be re-evaluated on some regular basis and deprecated if need be.

IIUC, stage 3 does not complicate revision based on unforeseen needs.

[mhdawson]

@MarcinHoppe in this stage we should move the files out of the proposal and into their final locations in the repo. I think that means finding the right place/name for REQUIREMENTS.md in the Cross Project Council Repo or Onboarding repo and updating other docs as appropriate to reference it (For example I think it should be referenced in the onboarding doc as one of the requirements)

[MarcinHoppe]

@mikesamuel @mhdawson Great feedback, I will work on that.

[MarcinHoppe]

Sorry for a little delay here but I've been on vacation. I'll move this forward before the next CPC meeting.

[MarcinHoppe]

Closing in favour of #633.