Security.md guidance

[vinzscam]

Summary

We need to have a security policy in place for when vulnerabilities found and reported. We should look to copy as much as possible from the backstage/backstage repo.

• GitHub Security Advisories are a good process that we found useful, let's copy that.
• Let's copy over some of the best practices from the other repo too.
• Snyk / Renovate / Dependabot guidance too?

[nickboldt]

I could probably copy some config from janus-idp repos for renovate and snyk setup (as PRs).

[BethGriggs]

I notice this has fallen off our list a little. Today, if someone wanted to report a security issue in a plugin - where would they go? Should we start by documenting that?

[BethGriggs]

SECURITY.md now exists, we'll iterate as needed