Update security reporting policy

[tigrannajaryan]

TC and GC discussed and decided that we want to make Github security reporting capabilities the primary reporting channel.

We will need to update the policy document and make sure all repos have the vulnerability reporting feature enabled (including new repos).

cc @open-telemetry/governance-committee @open-telemetry/technical-committee

[yurishkuro]

PR to the policy attached.

[yurishkuro]

I enabled "Private vulnerability reporting" on all repos. Wish GitHub would have org-level settings that would override individual repo defaults.

[yurishkuro]

turns out GitHub does support bulk updates of security settings, but the vulnerability reporting is not one of them, perhaps because it itself is in beta: https://docs.github.com/en/enterprise-cloud@latest/code-security/security-overview/enabling-security-features-for-multiple-repositories