Instructions for how to report a security vulnerability

Despite our best efforts, it's likely that a security vulnerability will be discovered by a non-contributor out in the wild. It would be good to have a page instructing them how to best report the issue so that it can be resolved. I imagine that a lot of security issues can be reported as basic GitHub issues, but I believe we need to allow for the possibility of an exploit that is so dangerous that it would be better not to publish it until after we have a fix in place.