Add Reporting Vulnerabilities section to Security Policy

[tisonkun]

Fixes #16919

• doc

[tisonkun]

cc @hpvd @sijie @merlimat @eolivelli

[lhotari]

I hope that the information about the vulnerability handling process could also be added to SECURITY.md . Duplication of information is justified in this case. Hiding relevant information behind yet another click could result in information being missed.

I'd suggest that we also add these sentences to SECURITY.md:

The Pulsar community follows the ASF vulnerability handling process.

To report a new vulnerability you have discovered please follow the ASF vulnerability reporting process.

[lhotari]

Oh, I see that @tisonkun already suggested inlining the information in #16919 (comment) .

[tisonkun]

@lhotari I'm OK to duplicate the information but the current state is acceptable for me and I think it resolves the original issue.

If you'd like to duplicate the information, you can submit a patch :)

[lhotari]

@lhotari I'm OK to duplicate the information but the current state is acceptable for me and I think it resolves the original issue.

If you'd like to duplicate the information, you can submit a patch :)

@tisonkun I made #17039 as a follow-up