Clarify criteria for private distributor list membership

[htuch]

We adopted https://github.com/envoyproxy/envoy/blob/master/SECURITY_RELEASE_PROCESS.md#membership-criteria based on k8s. Envoy has a somewhat different deployment context, for example it's used for IaaS, SaaS, PaaS, on-premise, embedded in other products, shipped in Linux distributions, operated by Cloud scale operators, etc. Today membership is based on rigid criteria and does not reflect the likely impact of membership or community participation of members.

We should clarify membership criteria in light of this based on community input. The tension is between keeping the list small enough to ensure high likelihood of maintaining the embargo and large enough to protect the most users.

Action item for CVE-2019-9900
Action item for CVE-2019-9901