Configuring security email needs attention

[krassowski]

Currently some security group members receive emails from security@jupyter.org and some (minority?) from security@ipython.org. It appears that some mails sent to security@ipython.org do not get delivered at all, which is a dire issue.

1. Can we make sure everyone who needs access has access
2. Can we update the SECURITY.md and jupyter.org to point to security@jupyter.org if that is to be used going forward?

[dlqqq]

This may be preventing me from getting emails since my email domain is qiu.dev: https://docs.github.com/en/enterprise-cloud@latest/admin/enforcing-policies/enforcing-policies-for-your-enterprise/restricting-email-notifications-for-your-enterprise#restricting-email-notifications-for-your-enterprise

[krassowski]

For context @dlqqq's message was regarding security manager notifications for private advisories, not the incoming messages to security@jupyter.org or security@ipython.org. We may want to explore a way to send a feed of private advisories to security@jupyter.org, or we need to find a way to ensure that security managers can get emails/notifications for all repositories they have access too (regardless of their watch settings, this is that they should not need to opt-in for every repo to get notifications about new GHSA)