[WIP] Security policy

Looking for early feedback on the direction I'm going.

I'd like to make this a security policy that developers actually want to read.
For organizations, we add @houndci to organization team `Services` (or create it first if it doesn't exist).