Update iOS security bug triage process.

There are two changes based on discussion with iOS Chrome team and the
security team:

1. Loop in iOS Chrome team on WebKit security bugs so they can monitor
   status, in case a workaround was landed in iOS Chrome for that bug.
2. Update the mechanism to notify Apple friends per request from
   ddkilzer@apple.com.

Change-Id: I5141a0af8374ee35b2953587bd647cab431600d7
Reviewed-on: https://chromium-review.googlesource.com/c/1337485Reviewed-by: Eugene But <eugenebut@chromium.org>
Commit-Queue: Andrew Whalley <awhalley@chromium.org>
Cr-Commit-Position: refs/heads/master@{#611383}

docs/security/sheriff.md

@@ -232,10 +232,12 @@ necessary bugs.
 
 * Reproduce using iOS device, desktop Safari, or [Browserstack](http://browserstack.com/)
 * Assign severity, impact, milestone, and component labels
-* CC Apple friends (if you don't know who they are, ping awhalley@)
 * Label **ExternalDependency**
-* File the bug at [bugs.webkit.org](https://bugs.webkit.org) or with
-  product-security@apple.com.
+* Label **Hotlist-WebKit**. This label is monitored by Apple friends.
+* File a security bug at [bugs.webkit.org](https://bugs.webkit.org), and CC
+  chrome-ios-security-bugs@google.com. This alias is monitored by iOS Chrome
+  team so they can be notified when the WebKit bug is fixed.
+* Note the WebKit bug ID in the crbug report.
 
 ### Find An Owner To Fix The Bug