Draft: Clarify responsibilities of vuln scan and triage

There was a discussion about ownership of triaging security scanning reports. The plan was that the Threat Management team will pick this up and they are hiring these roles.

This MR clarifies who does the scanner runs and who triages the scanning reports.