When enabled, it will use the new gitlab-org/security remote on
gitlab.com, and is mutually exclusive from `--remote`.

After the new workflow is finalized, we can remove this flag and make it
the default behavior.