Update Security Policy and SECURITY.md

[feanil]

Currently SECURITY.md points to the edX security policy. We need to publish the Open edX security Policy and then update the document to point to this instead.

Should the new security policy just live in SECURITY.md? Should it live somewhere else?

We should also include the security contact info in SECURITY.md so people know how to report issues.

[alangsto]

Draft of new policy here: https://docs.google.com/document/d/1zqbKgVN1EJZBVsv2F6wOMjGX1an1wssq05W1Yli1qSA/edit#

[feanil]

Looks pretty good, once we get the couple of suggestions resolved, I can send a copy to Nell to get her changes.

[alangsto]

@feanil updated based on suggestions

[feanil]

Sounds good, I'll send it off to Nell for review but she's on vacation for the next 10 days so it will be a while before we hear back.

[alangsto]

@alangsto will email Nell to ask if the security policy should live anywhere else besides security.md