Add `--security-remote` flag to bin/secpick

Part of #37478 (closed)

When enabled, it will use the new gitlab-org/security remote on gitlab.com, and is mutually exclusive from --remote.

After the new workflow is finalized, we can remove this flag and make it the default behavior.