Add directories and files for keys, canaries, CVEs, audits

[j01tz]

TODO:

• Review format for storing audit/ data
• Review keys/ to make sure all keys are accurate, no keys are missing and no unnecessary keys are provided
• Add and verify signatures for canary-001 for @lehnberg and @hashmap
• Review to ensure clarity regarding security/responsible disclosure policy
• Update SECURITY.md to reflect new grin-security repo data

Work in progress to populate grin-security with necessary pieces. Feedback is appreciated regarding clarity, sufficiency, formatting, accuracy etc.

[j01tz]

The PGP keys in keys/ should be committed by the key holder (ideally with a signed commit using that key). For now the minimum keys are the security disclosure contacts but it might be nice to have PGP keys for other core developers in one auditable place.

@lehnberg do you mind taking a look at the audits/ and canaries/ directories to make sure we are on the same page wrt formatting?

Once the structure looks good we need @lehnberg and @hashmap to add PGP keys to keys/ and canary signatures in canaries/. Feel free to ping me on keybase with any questions on signatures etc.

Once this is complete and this PR is merged to master I can update mimblewimble/grin#3009, completing the implementation for RFC-003.