Tor-wide security policy

Tor Project currently has not general security policy. We need to work out a security policy that covers all of Tor: See https://trac.torproject.org/projects/tor/ticket/13968#comment:27