HackerOne acts as Node.js' CNA today via /cve_requests. The OpenJS
Foundation runs its own CNA and exposes an API at
https://cna.openjsf.org/api.html that can issue CVEs through that
channel without leaving NCU. Add an opt-in path that routes
reservation and publication through the OpenJS CNA, keeping HackerOne
as the source of truth for the bug-bounty workflow.

Setting \`cve_source: 'openjs-cna'\` in \`.ncurc\` switches the source.
The default (\`hackerone\`) preserves the existing behaviour. The CVE id
is pushed back to the HackerOne report either way so the report still
carries it.

  * \`cna\` lazy auth accessor reading \`openjs_cna_token\` and
    \`openjs_cna_worker_url\` from \`.ncurc\`. Both treated as encrypted
    secrets (\`-x\`).
  * Five Request methods (\`cnaDispatch\`, \`cnaPoll\`,
    \`cnaWaitForCompletion\`, \`cnaReserveCve\`, \`cnaPublishCve\`).
  * New \`git node security --publish-cve\` subcommand, scoped to the
    OpenJS CNA path, that POSTs a v5.2 CNA Container per reserved CVE
    to MITRE. Run after the release ships on nodejs.org.
  * \`vulnerabilities.json\` -> v5.2 CNA Container mapper. The reference
    URL is derived from \`releaseDate\` so the MITRE record points at
    the same blog-post slug \`SecurityBlog#getSlug\` produces.
  * Prerequisites section in \`docs/git-node.md\`.
  * Unit tests for transport, slug helper, and mapper.

Signed-off-by: Ulises Gascon <ulisesgascongonzalez@gmail.com>