Document some best practices related to vendor import:

Summary:

• Verify the source code comes from a trustworthy source.
• Always review the diff before importing.
• Run configure scripts and alike in an isolated environment.
• Perform tests inside chroot, jail or in VM first.

Reviewed by: emaste, imp
Differential Revision: https://reviews.freebsd.org/D44557