Security guidance

A recent post-mortem suggested we add guidelines on common things to look out for security-wise (though mostly this is just 'look at OWASP top 10') with a few Rails-specific things.

This is a stab at that by @bradleywright & me.

I've also added a step to the PR guidance. We should definitely be thinking about security implications of changes when we are reviewing PRs.
Is it worth mentioning that we use/should use [Brakeman](http://brakemanscanner.org/)?