OpenSSF GitHub repo management

[jorydotcom]

We need to define & document access/permissions for leads and participants in OpenSSF working groups and their repos. This includes policy questions (like enforcing 2FA and adding apps).

[AevaOnline]

My 2c... this policy should cover, at minimum, the following aspects:

• security policy requirements for all repos and accounts with commit rights
• roles & responsibilities for LF/OpenSSF Staff
• roles & responsibilities for repos that are "owned" by Technical Initiatives (Projects, WGs, etc)
• how roles are both documented and applied within each separate repo in a consistent way (e.g., is there a bot which automatically updates GH settings based on in-repo files? This is preferable to manually updating GH settings, IMHO.)

[ljharb]

I'm working on this - first steps are converting repo access to be all team-based instead of individual, and then to use automated tooling so readme lists are kept up to date automatically.

Once that's done, then I'll tackle the bigger question of who should have what access, which is what I think this issue deals with.