Move Auth to beta status

[jberkus]

The last three patch releases have made it clear that the RBAC in etcd Auth was never really completed when the original feature was added, and it should never have been made GA. At this point, we are serving our users poorly by letting them believe that they can rely on Auth to fully protect their data against hostile users.

I propose that we officially designate etcd Auth as a beta feature, flagging it as such in our documentation (and making an announcement), until such time as it looks to be actually fully implemented. This would have the benefits of enabling new contributors to work on missing checks in RBAC instead of limiting it to the SRC, as well as lowering the workload of the SRC.

Since we're in the middle of 3.7, we can't put it behind a feature gate, but if it's still beta in 3.8 we should consider feature gating it.

[jberkus]

Conclusion from the etcd community meeting:

We will:

• flag it as beta in the docs, and announce to our users/contributors (and solicit contributions)
• move all security reports to regular issues
• Bogdan's team to take ownership
• restore to GA once we have confidence in the feature

[ahrtr]

• Bogdan's team to take ownership

We should add Bogdan to the security committee first. Otherwise, it doesn't make sense that six security members aren't handling the security issues, while we rely on a non-committee member to handle security issues.

Thanks @lavacat for volunteering to work on this!

[jberkus]

See "move all security reports to regular issues" above.

[lavacat]

I see one issue related to RRAC
#22065
assigned that to myself

Do we need to do a review of all methods? Maybe using some AI scanner + manual. Can you file the issue?
Are there any reports related to RBAC via security channel that aren't filed as issues?