CNCF Sandbox requirements

[carlesarnal]

Summary

Adds the files required for the CNCF Sandbox application (cncf/sandbox#461), addressing feedback from the CNCF review.

Files Added

• SECURITY.md — Vulnerability reporting process, supported versions table, response timeline, and security best practices for deployers
• ADOPTERS.md — Adopter listing (KubeVirt-style format) with PR-based contribution instructions, seeded with IBM and Red Hat as known vendors
• GENERAL_TECHNICAL_REVIEW.md — Completed Day 0 (Planning Phase) portion of the CNCF General Technical Review questionnaire, covering Scope, Usability, Design, Installation, and Security

CNCF Sandbox Application Checklist

Required files (this PR)

• SECURITY.md — Vulnerability reporting process and supported versions
• ADOPTERS.md — Adopter listing with PR contribution instructions
• GENERAL_TECHNICAL_REVIEW.md — Day 0 questions answered (living document)

Application fields to address

• Security policy file link updated in sandbox issue
• Adopters link updated in sandbox issue
• Domain Technical Review updated to reference General Technical Review (replaces old TAG presentation approach — TAGs have been restructured)
• Maintainers file — Currently pointing to pom.xml#L27-L69. Consider creating a standalone MAINTAINERS.md
• Contribution Agreement signatory — Signatory name and title still TODO in the application

Community & governance actions

• Populate ADOPTERS.md — Outreach email drafted (ADOPTERS_OUTREACH_EMAIL.md). Potential adopters identified from last year's contributors: Bloomberg, Axual, Libon, Castor EDC, Mollie, INNOQ, Generali Italia, Heetch, Ledger, Solace, Farfetch, Tietoevry, and others
• GOVERNANCE.md — Recommended (not strictly required for Sandbox) but strengthens the application
• CNCF contacts — Identify TOC or TAG members familiar with the project (besides @angellk)
• Neutral GitHub organization — CNCF onboarding requires moving to a separate neutral org (post-acceptance)

Future work (not blocking Sandbox)

• CNCF Security Self-Assessment — Plan to complete during Sandbox onboarding
• General Technical Review Day 1 & Day 2 — Extend for future Incubation application
• OpenSSF Best Practices Badge — Recommended to start working on

Context

These files address specific feedback received on the CNCF Sandbox application:

1. Security policy was missing — now provided with vulnerability reporting process
2. Domain Technical Review referenced TAG presentations that no longer exist (TAGs restructured) — replaced with the General Technical Review questionnaire as recommended
3. Adopters file was empty — now created with structure and contribution instructions, following KubeVirt/Harbor patterns

Test plan

• Verify SECURITY.md renders correctly on GitHub
• Verify ADOPTERS.md renders correctly on GitHub
• Verify GENERAL_TECHNICAL_REVIEW.md renders correctly on GitHub
• Verify links from sandbox application issue #461 resolve to these files