Discussed in a DM with rh-ee-ellinand nickboldt, we can't have OCI manifests visible to Prodsec because we are not declaring support for them yet.

From historical discussions with Rogue, his suggestion was to use the push-to-registry pipeline instead of rh-advisories. See referenced discussion from #konflux-user which confirms this is the process

We can ship with Prodsec's approval once this is ready