Create document on guidance for supply chain management

[johnmark]

[johnmark]

Start with guidance from OSR and OpenSSF, adding more details for highly regulated environments.

Final publication could be on OSR, OpenSSF, or Finos