Nag patch author for bugs flagged `in-testsuite?` to finally land it, once a bug is derestricted

[mozfreddyb]

[marco-c]

@mozfreddyb how important do you think this is?

[mozfreddyb]

I think it's overdue. The background is that whenever we ship high-severity security vulnerabilities, we are asking people to hold off landing a test, as it would make it easier for attackers to reproduce the issue and build security exploits based off of those.

We're generally good at not giving away too much stuff, but we sometimes forget landing the test at all. Over time, we've build quite a backlog of security issues that have unlanded tests (sometimes with and sometimes without the in-testsuite? flag. So the whole issue is a bit bigger than this, but definitely worth getting to, even if in slow iterations.

P.S: The bug was filed in response to a thread on dev-platform "Land your tests for now-public security bugs" back then.

[marco-c]

There is a discussion in #1464, we are re-evaluating what to do here.