[WIP] Security policy

Looking for early feedback on the direction I'm going.

I'd like to make this a security policy that developers actually want to read.
I like the way the underscores all the way across reads. Hits the "Markdown is readable by itself" note for me, one of the things I like most about Markdown.