docs: add security policy

[iamdadmin]

I offered to type this up in the Discord a while ago, Aidan said to go ahead, so now committing this for review.

It's just a light touch and from what I can see outwardly just covers off what you're already doing.

I drew guidance from the following:

• https://symfony.com/doc/current/contributing/code/security.html

• https://github.com/github/opensource.guide/blob/main/_articles/security-best-practices-for-your-project.md

• Personal knowledge (I'm an InfoSec Consultant)

If you'd like me to go into more detail or add anything else, I'm happy to work on it.

You may also need to manually link it in the "Security and quality" tab if it's not automatically detected.

In the initial commit I did suggest a security shared email address, but as GH has a private submission form which goes to core maintainers, I just updated to use that link.

[innocenzi]

Only a syntax review, I haven't checked the policy itself, will need @aidan-casey, @xHeaven and @brendt's review

[iamdadmin]

Only a syntax review, I haven't checked the policy itself

Obviously I can make all of those changes, but from a grammar standpoint;

• Security Policy is a proper noun, it's a type of policy,
• Security Issue is a proper noun, it is a type of issue,
• Pull Request equally is a proper noun, it has a well-known GitHub definition
• Multi-Factor Authentication is a proper noun, it refers to a specific technology which has a well-known definition,
• Technically speaking Resolution Process is a proper noun as it is a type of process, but as I'm effectively defining it within the document, instead of it being a pre-existing definition, it could go either way.

So in this context, most of those should in fact be capitalised where used.

If you need the headings to follow the convention so only the first character is a capital, I can re-work it so it doesn't use the proper nouns, but the references within the paragraphs themselves should remain capitalised. Would that work? (And I can obviously do a commit changing TempestPHP to Tempest...)

[innocenzi]

Sorry, but you're incorrect. None of those are "proper nouns", they're actually common nouns, even those referring to very specific concepts.

Let's stick to sentence case to stay consistent with the current documentation and keep it easy to scan

[github-actions]

This pull request is stale because it has been open for 30 days with no activity.

[github-actions]

This pull request was closed because it has been inactive for 1 day since being marked as stale.

[aidan-casey]

Generally I think this looks good. Let's get these changes made and get it merged.

[aidan-casey]

Suggested change

	If you think you have found a security issue within Tempest, don't create a GitHub issue and don't publish a pull request with proof of concept. In the first instance, report issues using [GitHub's security advisory reporting mechanism](https://github.com/tempestphp/tempest-framework/security/advisories/new), with as much information as you can provide, ideally including steps-to-recreate. Security reports submitted on this page are forwarded to the core maintainers only.
	If you believe you have discovered a security issue in Tempest, please do not create a GitHub issue or publish a proof-of-concept pull request.
	Instead, report the issue using [GitHub's security advisory reporting mechanism](https://github.com/tempestphp/tempest-framework/security/advisories/new) and provide as much detail as possible, including steps to reproduce the issue where applicable. Reports submitted through this process are visible only to the core maintainers.

[aidan-casey]

Suggested change

	The core maintainers will determine whether this is classified as a security issue, and address it accordingly, or whether it is classified as a regular bug, and may ask you to raise a GitHub issue instead, at this time.
	The core maintainers will determine whether this is classified as a security issue, and address it accordingly, or whether it is classified as a regular bug, and may ask you to raise a GitHub issue instead.

[aidan-casey]

Suggested change

	The core maintainers will aim to acknowledge and validate any reported security issue promptly.
	The core maintainers will acknowledge and validate reported security issues as promptly as possible.

[aidan-casey]

Suggested change

	Following the validation of a security issue, the core maintainers will broadly:
	Following the validation of a security issue, the core maintainers will:

[aidan-casey]

Suggested change

	4. Notify all subscribed Tempest parties via the usual channels (discord, blog, etc) that the updated is published.
	4. Notify all subscribed Tempest parties via the usual channels (Discord, blog, etc) that the updated is published.