add security.txt

[syphar]

this is a standard format for domain owners to provide information about security contacts, policies etc.

https://securitytxt.org/

• https://crates.io/.well-known/security.txt
• https://rust-lang.org/.well-known/security.txt

I think we should add this route, question is only what to link to.

The crates.io policy? our own?

[syphar]

cc @rust-lang/security ?

[cuviper]

I think you probably need your own page similar to the crates.io one, where issues with docs.rs itself are directed to the main Rust Project policy, but issues with the documented crates should go to their respective projects.

[syphar]

I'm not sure if I would feel confident enough writing up a security policy :)