Function plan_security 

pub fn plan_security(
    repo: &str,
    current: &SecurityState,
    desired: &SecurityConfig,
) -> RepoPlan

Diff the current security state against the desired config.