First draft of security doc covering minion/etcd isolation