[no_severity_nag] Exclude security bugs instead of all confidential bugs

[suhaibmujahid]

Following up on #2536 (comment)

Currently, we depend on the "sec": false config to exclude security bugs, which exclude confidential bugs as well (see #2536 (comment))

If we decide to go with this route, we may want to change the behaviour of the "sec": false config instead of having a custom fix to the no_severity_nag rule only.