Update security.adoc with some guidelines on dealing with vulnerability

After some offline discussion with @wbeaton, we coauthored some guidelines, which result into this PR. Please take a look to see whether you have any comments.