Describe the disclosure process and where security notices appear

[Gorka Gonzalo (d0ubl3g)]

Documentation only.

• SECURITY.md
  • What happens after you report: acknowledgement within 3 business days, first assessment within 10 business days, status updates at least every 14 days; fix targets by CVSS v3.1 severity, counted from the first assessment (critical 7 days, high 30, medium 90, low in the next release); a 90-day coordinated disclosure period, earlier with workarounds if the vulnerability is actively exploited; a safe-harbour clause.
  • Security notices: where users are told about an actively exploited vulnerability or a severe incident, in order: the repository's security advisory, a short notice at the top of the README, then the fixed release's notes.
  • How advisories are published: on GitHub, from a fixed template, with a GHSA identifier; a CVE identifier, when needed, is requested through the advisory with GitHub as the CVE Numbering Authority.
  • No bounty programme and no encrypted email at the moment; reporters are credited in the advisory if they want to be.
• docs/security-advisory-template.md (new): the fields every advisory has, matching GitHub's advisory form, and how to update for each install channel.
• README.md: a link to the policy near the top, an empty comment-delimited block for a security notice (the README renders as before while it is empty), and a link to the advisories page.
• CHANGELOG.md: one sentence added to the existing documentation entry in Unreleased.

The reporting channels do not change: GitHub private vulnerability reporting and security@hodeitek.com. "Supported versions" is unchanged (#127).

Refs #120