Add specific security inclusion guidelines

Fixes #1685 (closed)

Would love some feedback on this - I feel like this list isn't really good enough but I'm not sure where to go from here.