Don't add new non-team collaborators to existing GHSA tickets

[sethmlarson]

When someone joins the PSRT but isn't in the PSRT GitHub team their handle is added automatically to all open GHSA tickets, causing a lot of email to happen. For now we should probably not add new members to old GHSAs in a way that causes this amount of email.

[encukou]

Come to think of it: is there a reason against adding all PSRT members to the org?

AFAIK, org membership by itself doesn't give any permissions.
Making it fully open is a bad idea since people will want to join just to get the Python logo on their profile, but that's not really a concern for PSRT members.

[encukou]

I opened python/core-workflow#604 for visibility / Chesterton's fence.

[encukou]

Should be fixed now by not adding any external collaborators -- everyone who should be auto-added is on the team.

[sethmlarson]

Amazing, thank you @encukou for a much more elegant solution and @StanFromIreland for ripping out the logic. Much appreciated 💜