Update security process regarding who gets acknowledgement for finding vulnerabilities

The [https://docs.silverstripe.org/en/5/contributing/managing_security_issues/](security issue/release process) mentions giving acknowledgement to the reporter - but in some scenarios the reporter isn't the correct person to acknowledge, necessarily.

Acceptance criteria

• Doc is updated to reflect these scenarios:
  • The reporter is a digital agency or owner of a website who hired a third-party to perform a penetration test. The third party found a vulnerability.
    • In this case the agency and third-party should both be asked if they want to be given acknowledgement
  • The reporter is a staff member at Silverstripe, and they're reporting on behalf of a client who hired a third-party to perform a penetration test. The third party found a vulnerability.
    • In this case the client and third-party should both be asked if they want to be given acknowledgement

Start with the managing security issues page linked in the issue. Review the acknowledgement guidance and update it to cover agency or client reporters, Silverstripe staff reporting for a client, and third-party penetration testers. Done means both relevant parties are asked whether they want acknowledgement in each scenario.