Handle cases where a private bug is closed as a duplicate of a public bug

[suhaibmujahid]

NOTE
CC @dveditz

Private bugs should not be closed as a duplicate of public bugs unless the public bug is already a known security bug (has a sec-foo keyword), then it's fine to make the hidden bug a duplicate.

If the public bug does not contain vulnerability details, the security bug should "depends on" the public bug instead of being closed as a duplicate.

[suhaibmujahid]

Suggested solution: we could add a BugBot rule to reopen the private bug and mark it as “depends on” the public bug, unless the public bug already has a “sec-*” keyword.

[dveditz]

It would be great to reference our security-bug dupe-handling guidelines. I'll try to get that into some appropriate place in Firefox source docs so you can switch to a publicly accessible link, but the above will do for now.