Add security/policies.adoc documenting security team policies for
issue submission, advisory criteria, embargo, confidentiality,
advisory publication, and backporting. Includes placeholder for
security team to detail specific advisory criteria.

Update security/_index.adoc to link to new charter and policies
documents.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>