embargoed releases: also describe the git-security list and the process

embargoed releases: also describe the git-security list and the process

With the recent turnover on the git-security list, questions came up how
things are usually run. Rather than answering questions individually,
extend Git's existing documentation about security vulnerabilities to
describe the git-security mailing list, how things are run on that list,
and what to expect throughout the process from the time a security bug
is reported all the way to the time when a fix is released.

Helped-by: Junio C Hamano <redacted>
Helped-by: Taylor Blau <redacted>
Signed-off-by: Julia Ramer <redacted>
Signed-off-by: Junio C Hamano <redacted>