Update the security guide

Bunch of changes, many recommended by Jason Rogers and Michael
Lang.  In addition to the changes in the guide itself, make it
more prominent by mentioning it in the README, and making it
the second link on the documentation page, directly after the
README.

Because the core_extensions are still used by default, include
their documentation in the Core/Model documentation.
Escape ] characters in identifiers on Microsoft SQL Server

This also adds a spec for identifier escaping.
Oracle can't escape identifiers