[WIP] Security policy

Looking for early feedback on the direction I'm going.

I'd like to make this a security policy that developers actually want to read.
The AVAILABILITY document came out of the same customer request. They were asking for something like an SLA. I was going to write something like Heroku's promise:

* We'll do everything we can to achieve 100% uptime
* We will never achieve 100% uptime, but when we fall short, we'll explain why and how we'll do better next time