I'm not sure what the "Mozilla Legal" process is, but this thread[0] from 2012 seems to be a recurring source of authority on decision-making around this, from my reading of Bugzilla.
This is what tofumatt was referring to when closing this Github thread.