Add automatic notification of owners for 90-day SLA

[toolness]

Jacob wrote:

3. Automate reminders about open issues: we have a 90-day SLA on fixes, and our plan is to remind owners (via email and/or Slack) about open issues on every "half-life" (so day 45, 22, 11, 5, 3, 2, and 1).

Need to do this. I have questions about how to determine the "owner" though--is this obtainable through the H1 API metadata, or do we need to maintain it separately ourselves?

I'm also assuming that holding onto their email address for purposes of notification isn't classified as sensitive PII for the purposes of a pre-assessment ATO.

[toolness]

Details on how to figure out the "owner" are in #15. We basically need to do this on our end, associating StructuredScope assets with projects/people.

We should probably have a fallback behavior whereby we nag the overall bounty program owner if no person is associated with the asset.

[jacobian]

So - it's becoming apparent that we may not need this; we're likely going to be manually reviewing open issues regularly anyway. I'm going to keep this open in case we change our mind, but let's not work on it 'til we decide we actually need it.