Merge branch 'js/security-md'

SECURITY.md that is facing individual contributors and end users has been introduced. Also a procedure to follow when preparing embargoed releases has been spelled out. * js/security-md: Document how we do embargoed releases SECURITY: describe how to report vulnerabilities