[WIP] Security policy

Looking for early feedback on the direction I'm going.

I'd like to make this a security policy that developers actually want to read.
The webhook is only needed for Hound to receive PR notifications. Maybe simplify this to "This allows us to receive pull request notifications"?