[WIP] Security policy

Looking for early feedback on the direction I'm going.

I'd like to make this a security policy that developers actually want to read.
How about using `#` for headers? This way if the title changes the amount of underscores doesn't need to change.