Document Third-Party Security Audit Findings by NCC Group as Github issue

[andrii-kravets-x]

Proposal

Similar to how the Kubernetes project tracks third-party security audit findings (e.g., Kubernetes 1.24 Third-Party Security Audit Findings), this issue proposes creating an umbrella issue to track findings from the NCC Group audit and related discussions.

Context

• NCC Group conducted a third-party security assessment of Google Confidential Space.
• The public report is available here: https://www.nccgroup.com/research-blog/public-report-google-confidential-space-security-assessment/

Rationale

• Publicly documenting and tracking audit findings promotes transparency
• If the audit identified actionable items relevant to Confidential Space users, workloads, or supporting tools (such as those in this repository), tracking them here would be valuable.