[WIP] Security policy

Looking for early feedback on the direction I'm going.

I'd like to make this a security policy that developers actually want to read.
I would say "refresh your GitHub repositories in Hound" or something similar. We stopped referring to this action as "sync" since it's a one-way update, not really a sync.