Updates to the security policy

[pietroalbini]

The PR makes multiple changes to our security policy:

• Clarifies which branches we support (latest stable, beta, nightly).
• Clarifies we only email distros@openwall when the vulnerability is relevant to them (this is our standard practice anyway).
• Mentions that we loop relevant members of the Rust team in vulnerabilities, who review the fixes.
• Removes the 6 hours delay notice for the blog post, as in the last few years we always published it at the same time as the announcement in the mailing list.
• Adds information on when we publish CVE records, as requested by MITRE.
• Removes the prompt to encrypt emails with gpg.

cc @rust-lang/security