Define a security policy

[jpmcb]

cobra needs a security policy.

Generally, this should define:

• How users should report vulnerabilities
• How cobra maintainers respond
• How known security vulnerabilities and CVEs are communicated to the community

Inspiration from Open Web Application Security Project

We'd also like any input from the community since, in the end, all these policies serve the community