docs: consolidate security policy
Created by: nicksnyder
This PR does three things:
- Remove a link to HackerOne since we don't use that.
- Document when we issue rewards. My proposal is after we have confirmed the issue is fixed.
- I found 3 different security related READMEs and I think there should be only 1, so I consolidated the content (see also https://github.com/sourcegraph/sourcegraph/pull/7906).