docs: Add security disclosure policy

[orpheuslummis]

Relevant issue(s)

Resolves #1205

Description

Rendered

Introduces a security disclosure policy for DefraDB, and more generally for the organization. This policy or other variations could be useful for other D2 projects. The rationale can be found on this doc: https://source.almanac.io/docs/security-disclosure-policy-80d5eb85cef6441a85827db6ccce0772?docView=Editing

Additional action items for the organization:

• Creation of [email protected] hotline with someone or two responsible for quick response upon vulnerability disclosure
• The aforementioned people to perform a practice drill of complete security vulnerability discovery lifecycle
• Email is unsafe. Therefore, creation of secure channel for disclosure, for example PGP email for [email protected], or a Matrix address such as @security:source.network, etc.

Future tasks related to this will include:

• Define a public policy for which exact versions of our systems we offer security support
• Creation and maintenance of a Security hall of fame page

How has this been tested?

Humans

[AndrewSisley]

LGTM, and a good starting point. I'm approving but I'd suggest leaving this open for others to look at first :)

[fredcarle]

Question: Was this produced based on some existing security disclosure policy elsewhere?

[orpheuslummis]

Question: Was this produced based on some existing security disclosure policy elsewhere?

Yes, I looked at various ones (see included issue/discussion and document) and quite liked the Matrix one (lol) so it is very similar. https://matrix.org/security-disclosure-policy/ I'm not sure if it's worth mentionning that or having more differentiation?

[jsimnz]

Love it, simple and to the point. LGTM.

[jsimnz]

Unrelated: How the heck did this effect the code coverage, are markdown files somehow included?

[AndrewSisley]

Unrelated: How the heck did this effect the code coverage, are markdown files somehow included?

P2P causes the code cov to bounce around a bit depending on the various concurrent elements that may or may not be hit on each test run.