added information about downstream projects included in our security issue resolving process

| Q             | A
| ------------- | ---
| Doc fix?      | no
| New docs?     | yes
| Applies to    | all
| Fixed tickets | n/a

We've been working closely with some Open-Source projects using Symfony during the last few months to better collaborate on security issues. I think that this is a good idea to be transparent about this process as well, and this PR describes how it works today.