Add a "Governance Documents" section and add the security policy

Let's consider expanding the single sentence on governance documents into a full section, turning the list of documents into an actual list (along the lines of what we've done in newer policy documents, e.g., the EFSP), and adding the security policy to that list.

@mbarbero