Guidance/Requirements for assets managed and controlled by OpenTelemetry

[svrnm]

This is a follow up to a meeting of the Project Infra SIG and this issue, I wanted to raise this for a while already:

Our community has, manages and controls a set of assets, which are (hopefully) in big parts listed in https://github.com/open-telemetry/community/blob/main/assets.md

If we look at the different assets ownership & management of them is very fractured and different, some are owned by only one or a few individuals. However, we need to ensure ongoing ownership and control of OpenTelemetry-owned assets, if all current owners/developers leave the project.

Therefore I raise this issue, such that the SIG Security can come up with requirements (and/or guidelines) for these resources.

cc @open-telemetry/project-infra