[WIP] Security policy

Looking for early feedback on the direction I'm going.

I'd like to make this a security policy that developers actually want to read.
I belive, `RepoSynchronizationJob` is the only job that stores the user's GitHub token, for a background sync. The activation, actually happens using the token from the session. All other usages of GitHub api are via Hound's token (since hound gets added to the repo during activation).