Add security policy document

Looking for early feedback on the direction I'm going.

I'd like to make this a security policy that developers actually want to read.
The payload doesn't actually contain any code. It's just a bunch of metadata about the pr (repo, user, commit, etc). We make a separate request to fetch the PR patch, and file contents.