docs: update security policy with private vulnerability reports info

[galargh]

Description

This PR updates the security policy to encourage users to file security vulnerability reports through https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability

The private vulnerability reports will show up here: https://github.com/libp2p/rust-libp2p/security/advisories?state=triage
The maintainers will receive GitHub notification about new private vulnerability reports.

Notes

Links to any relevant issues

Open Questions

Change checklist

• I have performed a self-review of my own code
• I have made corresponding changes to the documentation
• I have added tests that prove my fix is effective or that my feature works
• A changelog entry has been made in the appropriate crates

[mxinden]

Looks good to me. Thanks @galargh. I am assuming that this has been tested with a GitHub account that doesn't have any special permissions on the libp2p organization. Is that correct?

Would you mind updating the root README.md here as well?

rust-libp2p/README.md

Lines 16 to 18 in 5b4eab7

	- For **security related issues** please reach out to [email protected]. Please
	do not file a public issue on GitHub.

[galargh]

Looks good to me. Thanks @galargh. I am assuming that this has been tested with a GitHub account that doesn't have any special permissions on the libp2p organization. Is that correct?

Yes! Not on this repo but I did test the flow where the user has no affiliation whatsoever with the target repository (using https://github.com/web3-bot and https://github.com/protocol/github-mgmt-template to be exact).

Would you mind updating the root README.md here as well?

Done! a9862ed

[mxinden]

And could you include the update to the template below as well?

rust-libp2p/.github/ISSUE_TEMPLATE/bug_report.md

Line 8 in 5b4eab7

<!-- For security related issues please reach out to [email protected]. Please do not file a public issue on GitHub. -->

[thomaseizinger]

Adding send-it label to mark that we want to merge this as soon as we have #3213 sorted.