Developer manual: recommend a SECURITY.md in publishing.rst #15686

The app guidelines ask authors to respond to security reports in good time, but developer_manual/app_publishing_maintenance/publishing.rst doesn't say how to tell people where to report.

• Recommend a SECURITY.md in the app repository, saying how security issues are reported to the app's developers.
• Link the org's file as an example: https://github.com/nextcloud/.github/blob/master/SECURITY.md