security.txt: give vulnerability reports a clear way in

A practical guide to security.txt: publish a clear reporting contact, choose a sensible expiry date and keep the response process working.