Enforce the "GitHub Recommended" security configuration

The Jupyter enterprise is able to enforce a configuration across all Jupyter orgs. In the most recent security meeting, @rpwagner and I discussed working towards adopting this configuration and enforcing it in Jupyter's orgs.

I suggested that I will champion piloting its use in the JupyterHub org, and that we'll followup after we have gained some experience of using it.

Below you can see what the "GitHub recommended" advanced security configuration implies, as seen from an admin view of a GitHub org or the Jupyter enterprise. Note that adopting this would resolve https://github.com/jupyter/security/issues/73.