Security guidance

A recent post-mortem suggested we add guidelines on common things to look out for security-wise (though mostly this is just 'look at OWASP top 10') with a few Rails-specific things.

This is a stab at that by @bradleywright & me.

I've also added a step to the PR guidance. We should definitely be thinking about security implications of changes when we are reviewing PRs.
Minor point: I think this should be deserialisation.  i.e. automatic deserialisation of XML and YAML request bodies.