Add a policy for how staff should handle incident reports

This is taken verbatim from
http://2013.tcvegfest.com/handling-code-of-conduct-violations/, which in turn
is based on
http://geekfeminism.wikia.com/wiki/Conference_anti-harassment/Responding_to_reports
and is quite similar to the Pycon procedure
(https://us.pycon.org/2013/about/code-of-conduct/harassment-incidents-staff/).

I intend this to be a starting point, but I think having such a policy in
place is quite important.