[WIP] Security policy

Looking for early feedback on the direction I'm going.

I'd like to make this a security policy that developers actually want to read.
@sgrif You find this more readable:
```
Vulnerability Reporting
__
```
over
```
## Vulnerability Reporting
```
?