Document OSS vulnerability disclosure processes

[MarcinHoppe]

We've had several people present on OSS vulnerability disclosure processes in their organizations, but we haven't documented them outside of meeting notes. It would be great to document them as separate documents in this repo.

I was thinking about creating Markdown documents for:

• Node.js Ecosystem (@MarcinHoppe)
• Ruby (@reedloden)
• Arch Linux (@Foxboron)
• Red Hat (@RedHatCRob)

If I missed a presentation, please let me know!

[SecurityCRob]

I'm getting notes from the recent consult we did with the requested upstream project, but here is a historic blog we wrote as a suggested good practice for upstreams to follow around vuln. mgmt - https://access.redhat.com/blogs/766093/posts/1975833