Add security contact according to RFC 9116

[JanZerebecki]

This hopefully makes it to: https://cockpit-project.org/.well-known/security.txt

See also: cockpit-project/cockpit#20529

[martinpitt]

I copied this commit to my fork, and https://martinpitt.github.io/cockpit-project.github.io/.well-known/security.txt exists now. What kind of tools make use of that?

This is blocked until SECURITY.md actually exists. (I'd also like to move/rename that, but let's discuss that in the Cockpit PR).

[JanZerebecki]

It is primarily used by humans.

[Venefilyn]

I see that Red Hat has it

https://www.redhat.com/.well-known/security.txt redirects to
https://security.access.redhat.com/data/meta/v1/security.txt

We now have SECURITY.md within cockpit-project/.github so that is no longer a blocker. IMO we should fetch that during deployment and put it in https://cockpit-project.org/.well-known/security.txt