Add security policy page

This follows the guidance in
https://gds-way.cloudapps.digital/standards/vulnerability-disclosure.html#vulnerability-disclosure-and-security-txt

app/main/__init__.py

@@ -33,6 +33,7 @@ from app.main.views import (  # noqa isort:skip
     providers,
     register,
     returned_letters,
+    security_policy,
     send,
     service_settings,
     sign_in,