First draft of security doc covering minion/etcd isolation

Covers topics raised in #846 at a high level.