Improve security docs to include a 'hardened' configuration for an example scenario

[tsandall]

In August we had a thirdparty pen-testing firm conduct a security audit of OPA. The result of the audit can be found here. For the purpose of the audit we created an environment for the pen-testers that ran a hardened OPA configuraton. Details on the environment can be found here.

We should update the security documentation with details on the hardened configuration. Specifically, make a recommendation for cases where OPA is:

• Deployed as a daemon
• Configured to use bundles for policy distribution
• Accessed by services on the same host

In this scenario, OPA can be configured to:

• Only listen on localhost or a unix domain socket
• Enable TLS (in case of localhost)
• Only expose a single decision endpoint to clients (deny all other API requests)