Security guidance

A recent post-mortem suggested we add guidelines on common things to look out for security-wise (though mostly this is just 'look at OWASP top 10') with a few Rails-specific things.

This is a stab at that by @bradleywright & me.

I've also added a step to the PR guidance. We should definitely be thinking about security implications of changes when we are reviewing PRs.
I’m not sure this quite explains the problem or the solution. What I think this is trying to say (correct me if I’m wrong):

* SQL injection is bad
* don’t query things by concatenating user-supplied strings into SQL and running it

Would this be clearer with something like:

> Use ActiveRecord’s built-in methods and [SQL parameter sanitisation](http://guides.rubyonrails.org/security.html#sql-injection-countermeasures) to avoid SQL injection