using CODEOWNERS to request reviews on content/security PR's?

[raboof]

Hi! If I understand correctly, we'd generally like someone (maybe two?) from the security team to review PR's to files under content/security in the tree.

That's easy to miss. It looks like we could use a CODEOWNERS file to automatically request reviews from those people - how would you feel about trying that out?

[sebbASF]

Looks interesting.

Could also be used for files under content/legal.
And maybe content/licenses.

As long as the relevant people don't change too often, it should not be too hard to maintain the file.

Does the CODEOWNERS file need to require reviews?
Maybe it can protect itself? Can it accidentally become immutable?