Increase maturity level for BR-10

[evankanderson]

While BR-03 (website and version control for development PRs) and BR-09 (asset download for end-users) are relatively easy to measure for usage of security channels (HTTPS and/or SSH), it's much harder to measure whether or not every network call invoked during a build process used a secure channel.

Quoting from slack:

[Crob] is there a "tls = on"-like option in jenkins, etc.? boy that sure would be nice

[Evan] You'd need "tls = on" to flow into every other tool that Jenkins calls, too

[Crob] #grumble... yeah
[Crob] that reminds me, we have a security guide for configuring SCMs/VCSs. maybe the BEST wg needs to craft on for CI/CD and publishing too

[SecurityCRob]

i'm good moving this up one level

[funnelfiasco]

The reasoning here is sound.