Reorganize Django's security policy page

[Sarah Boyce]

Django's security policy has grown organically over time. The page would probably benefit being restructured to make it easier to navigate/read/digest.

The current structure is roughly:

Django's security policy
├── Reporting security issues
│   ├── Respecting maintainer time
│   └── Reporting guidelines
├── How does Django evaluate a report
├── Supported versions
├── Security issue severity levels
├── How Django discloses security issues
├── Who receives advance notification
└── Requesting notifications

• Some of the reporting guidelines describe what a reporter should include, while others describe the scope of issues Django will consider.
• Supported versions and severity are also closely related to the assessment process but currently sit separately.
• There are two notification sections which could be grouped

One possible reorganization would be:

Django's security policy
├── Reporting security vulnerabilities
│   ├── How to report
│   ├── What to include
│   ├── Scope and reporting requirements
│   ├── Respecting maintainer time
│   └── AI-assisted reports
├── Assessing security vulnerabilities
│   ├── How Django evaluates a report
│   ├── Supported versions
│   ├── Security severity levels
│   └── Issues outside Django
├── Disclosing security vulnerabilities
│   ├── Coordinated disclosure
│   ├── Advance disclosure
│   ├── Public disclosure
│   └── Exceptional circumstances
└── Security notifications
    ├── Who receives advance notification
    ├── Who does not receive advance notification
    └── Requesting notifications

I am open to other grouping/structure suggestions and would welcome us looking at other open source security policies to guide us on what would be best here.

[Natalia Bidart]

Accepting following on agreement from the latest security meeting.