Create a `.github-private` repo `expressjs`

[wesleytodd]

https://docs.github.com/en/organizations/collaborating-with-groups-in-organizations/customizing-your-organizations-profile#adding-a-member-only-organization-profile-readme

@ctcpip brought this up and I think it would be a great way for us to document some of the things going on in the project that are not security sensitive but also are more for internal operations. For example this kind of thing: #424

[ctcpip]

Keep in mind that everyone in the org will have access (including emeriti, etc.) so it may not be suitable for some things.

[wesleytodd]

As discussed on the call, we are good with creating this: https://github.com/expressjs/.github-private

[bjohansebas]

Since it’s a private GitHub repo and due to the organization’s settings, no member will have access unless they’re an admin/owner. You’ll need to explicitly grant access to each team or to the specific people you want to be able to see it.

We also can’t change the configuration to make private repos accessible to all members, because we have the vulnerabilities repo, and that one should only be accessible to the security triage team and tc members.

The most viable solution is to give read access to all the teams.

[jonchurch]

Next steps here seem to be, who should have access to this repo? And how can we ensure they do.

It'd be lowest level of private, basically just an internal repo for itnernal stuff.

The goal of this repo as I understand it is to just provide an Org readme that is only shown to org members, so low prio in general. So maybe even defining the point of this repo is the first step?

Can we verify if users who dont have read access to this repo can't see the private readme on the org level?