Reduce the effort of a core security release

Core security releases take a lot of effort.

It would be nice if they took less effort or if that effort could be spread more across different people.

The automated testing and prepping of the branch can take some time.

• private parallel core repo on gitlab, with gitlab testing enabled if we can do that without exposing commits or test results publicly
• between a patch release and a core release, we open a release branch (or 2/3/4 release branches)
• Security issues in merge requests against those branches with testing, merge when one is ready, branch also gets tested.
• is it OK to push a tag and not a branch to a different repo? If so we could push only the tags to the public core repo when we want to publish the release nodes.

Theoretically this would mean commits to the public core repo would no longer conflict at all. We'd need to merge the commits back into the minor branches and things can go wrong there, but that already happens after release sometimes.