Bipartisan bill would let review board decide if IT vulnerabilities should be made public or not