Add process for awarding ultimate license to H1 reporter

Why is this change being made?

Now that GitLab licenses are award to reporters with 3 or more valid reports, a process is needed for appsec engineers to hand out those licenses. This MR defines that process.

Does this MR meet the acceptance criteria?

Assign to DRI

• Did you assign this change to the correct DRI of the page or information you are changing?

Conformity

• Added description to this MR explaining the reasons for the proposed change, per say-why-not-just-what