Consider adding NetSec audit requirement

[clintwilson]

Now that CPA Canada has broken out the Audit Criteria which address assessment of compliance with the CA/B Forum's NCSSRs, we should consider requiring this audit (e.g. WebTrust Principles and Criteria for Certification Authorities – Network Security – Version 1.7 or later) within Section 8.4 of the SBRs.

[srdavidson]

Something like this?

[srdavidson]

For item 2, according to Dave Chin, the separate reporting for WebTrust for NetSec starts for audit periods beginning on or after April 1, 2025 and the minimum version should be bumped up to NetSec 2.0

[srdavidson]

Should also update the "Additional Compliance Date" table as follows

| -- | NS003 | Comply with Network and Certificate System Security Requirements, Version 2.0 | November 12, 2024 |

[srdavidson]

Draft text may be seen at srdavidson/smime@927a788...8919252

[srdavidson]

Note that a similar change needs to occur in the TLS BR.
cabforum/servercert#525

[clintwilson]

FWIW, I have an open PR for this in the TBRs here: https://github.com/cabforum/servercert/pull/514/files