Include OpenStack community guidelines and processes

The OpenStack community was one of the first to publish vulnerability management and secure development guidance documents under a permissive license, so has been re-spun and expanded on by a variety of other communities in the years since.