Add security policy document

Looking for early feedback on the direction I'm going.

I'd like to make this a security policy that developers actually want to read.
I would say that violations are collected in `Violations` class, which is then passed to `Commenter`.