Security guidance

A recent post-mortem suggested we add guidelines on common things to look out for security-wise (though mostly this is just 'look at OWASP top 10') with a few Rails-specific things.

This is a stab at that by @bradleywright & me.

I've also added a step to the PR guidance. We should definitely be thinking about security implications of changes when we are reviewing PRs.
Thanks @fatbusinessman and @alext; clarified and added link in d18c0ada.

@jamiecobbett can you give me an example of a repo that uses Brakeman that I could link to? I think it's worth mentioning here; though also worth noting that it did not pick up the issue which led to the post-mortem.