Add security policy document

Looking for early feedback on the direction I'm going.

I'd like to make this a security policy that developers actually want to read.
How about something like: `Using the information from the payload, Hound fetches file contents from the pull request. It then passes the file contents to `StyleChecker` ...`