Add process for GitLab-owned upstreams
Follow-up to https://gitlab.com/gitlab-org/security/gitlab/-/issues/951#note_1522871433 and this Slack discussion https://gitlab.slack.com/archives/CNZPN8BT3/p1692733000087029
We already had documentation for handling issues in upstream projects but sometimes the upstream repo is ours. This is now documented as well.