Document the Security and Disclosure process for Agones

[roberthbailey]

We should document how to file security disclosures. @thisisnotapril mentioned that there was a brief mention somewhere but I didn't see anything on the agones.dev site in a quick search.

Strawman: Copy https://kubernetes.io/docs/reference/issues-security/security/ or https://istio.io/about/security-vulnerabilities/ and set up a mailing list to a limited distribution. The distribution should probably initially be the TSC unless folks are interested in handling security issues who are not part of the TSC.

/cc @markmandel

[roberthbailey]

@thisisnotapril - This seems like low hanging fruit to finish before we cut 1.0. Thoughts?

[roberthbailey]

Right now if you file a bug, it mentions that if it's a security issue it should be disclosed privately but doesn't say where to report it:

If the matter is security related, please disclose it privately via

From https://raw.githubusercontent.com/googleforgames/agones/master/.github/ISSUE_TEMPLATE/bug_report.md

[roberthbailey]

ping...

[roberthbailey]

/assign @thisisnotapril

[roberthbailey]

Bump.

[roberthbailey]

I just found this old issue, and realized it was done in #2044.