Create a vulnerability disclosure policy

[fathyb]

It'd be cool if we have :

• an explicit document, both for maintainers and reporters (eg. https://github.com/bugcrowd/disclosure-policy)
• a mailbox redirecting to each maintainer email address, public issues shouldn't be used for this
• a tool like Snyk could also help prevent this ahead of time

Related #1783

[ghost]

AFAIK GitLab can do the mailbox thing

[DeMoorJasper]

Will close this due to inactivity. I don't really think it's that important for Parcel anyway as it will never really be accessible from the outside world, only real possible attack surface is third party plugins which is just a general danger of using npm