Security guidance

A recent post-mortem suggested we add guidelines on common things to look out for security-wise (though mostly this is just 'look at OWASP top 10') with a few Rails-specific things.

This is a stab at that by @bradleywright & me.

I've also added a step to the PR guidance. We should definitely be thinking about security implications of changes when we are reviewing PRs.
I think a link would be useful here, to demonstrate the nature of the attacks and explain the blanket ban. Something like http://blog.codeclimate.com/blog/2013/01/10/rails-remote-code-execution-vulnerability-explained/ maybe?