SLSA SO.3: Safe expunging process (Source L2 to L4)

An SCS may let the organization remove content and history without leaving a public record, but the organization must allow this only to meet legal or privacy obligations, knowing that removing a revision is like deleting a package version and can break every consumer of it, and that copies may persist elsewhere. The organization must write the process down, saying how requests and the actions taken are tracked, and should keep a log showing that content was removed; the SCS should need both an administrator and one or more other trusted persons before any removal runs. The logs may be kept private but should be public where possible.