Umbrella issue: Migrate CVE feed to run under cloud build

[tabbysable]

As extensively discussed in the Tooling subproject meetings, we are migrating the CVE feed generation off of the privileged build cluster. The recommended replacement from sig-k8s-infra folks is to run it in Cloud Build.

Overall steps:

• Create a GCP project
  • Done in Create staging project for k/sig-security repo cloud build k8s.io#7838
• Assign permissions for the GCP project
  • Documented in TODO: create dedicated google group for CVE feed maintainers #149
• Update GCS bucket permissions to allow cloud build job to write to it
• Define and deploy the cloud build job that will run the generation script
  • First step here is to figure out how to do so, probably by reading TF examples in https://github.com/kubernetes/k8s.io/blob/main/infra/gcp/terraform/

[tabbysable]

/triage accepted

[Pnkcaht]

I'm configuring Cloud Build access to the GCS bucket that hosts the CVE feed, but I can't find the Terraform definition for the k8s-staging-sig-security project in the k8s.io repo.

Could share the GCP project number for k8s-staging-sig-security?

I need it to grant write access to:

<PROJECT_NUMBER>@cloudbuild.gserviceaccount.com

Once I have this, I can open the IAM PR right away. @tabbysable