Add security.txt file to php.net

2. I have signed it with my php.net release manager key. Since we
   publish our release manager keys, I'm recommending that a release
   manager for a currently supported version of PHP (at the time) be the
   one to digitally sign this file after making changes.

Please document how to do that.

cheers
Derick

I've added documentation inline in the security.txt file, and I've also
opened a PR on php-src to update the release process documentation:

https://github.com/php/php-src/pull/12316

Cheers,
Ben

I've added documentation inline in the security.txt file

To add some nitpicky bikeshedding, I'd put those instructions elsewhere
(maybe php-src:docs/release-process.md ?) and only have a single line in
the security.txt file referring out to that. The focus of the security.txt
file should BE the metadata.

+1 on the concept, and I do like the idea of making it part of the new
branch release process as well as having one of the new RMs being the ones
to sign it.

-Sara

I didn't like having them in the security.txt file, either, but I
wasn't sure where to put them, since they're technically not part of the
release process.

I've updated my PR here: https://github.com/php/php-src/pull/12316

It has the instructions in a separate docs/security-policies.md file:
https://github.com/ramsey/php-src/blob/security-txt/docs/security-policies.md

The release-process.md doc is amended here (in that same PR):
https://github.com/ramsey/php-src/blob/security-txt/docs/release-process.md#preparing-for-the-initial-stable-version-php-xy0

And the security.txt file in web-php now looks like this:
https://github.com/ramsey/web-php/blob/security-txt/.well-known/security.txt

Cheers,
Ben