Document 3rd-party penetration testing process

Why is this change being made?

This addition to the handbook outlines the process for annual 3rd-party penetration tests of GitLab infrastructure. This is to provide guidance to relevant teams, as well as provide a reference for customers and auditors.

Does this MR meet the acceptance criteria?

Conformity

• Added description to this MR explaining the reasons for the proposed change, per say-why-not-just-what