Clarify RD policy

This clarifies our existing policy of only paying bug bounties through Bugcrowd.