TSC handbook: Add CRA guidance

[jemgillam]

Here is my first go at Cyber Resilience Act documentation for TSC members.

I have added sidebar positions to keep this and the page on CVE together. Currently many of the pages have no position though so it is quite near the top.

I think the CVE process probably needs documenting too? As if the incident is severe enough to be reported under the CRA chances are you will also need to report it through the CVE process. Currently that process is not documented.

As an open source steward, the only time a vulnerability needs to be reported if it is classified as "severe" under a particular definition. While the law talks about other types of exploits also being reportable, it doesn't apply here.

[benjie]

Thanks for preparing this!

It would be helpful to have a glossary of terms such as "PDE" and also detail which things are covered vs not covered; e.g. the spec itself I don't believe is covered, and I think Jory hinted that development-only tooling such as the VSCode extensions are also not covered - this may be a determination for the TSC to make, if so then links to the relevant criteria would make their lives easier, especially when new projects need to be evaluated in future.

[benjie]

Really helpful. I've tried to make this a little less "concrete" as, per LF, there are still some big question marks over some of this.